Stored Cross-Site Scripting in Stackable Page Builder Gutenberg Blocks for WordPress
CVE-2024-12117
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 January 2025
What is CVE-2024-12117?
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability in the 'title' parameter of the Button block. This issue stems from inadequate input sanitization and output escaping, allowing authenticated users with Contributor-level access and higher to inject harmful web scripts. These scripts will execute whenever a user visits an affected page, posing significant security risks to site visitors.
Affected Version(s)
Stackable – Page Builder Gutenberg Blocks * <= 3.13.11