Stored Cross-Site Scripting Vulnerability in Gutenberg Blocks with AI by Kadence WP
CVE-2024-12304

6.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Gutenberg Blocks With Ai By Kadence WP – Page Builder Features
Vendor
CVE Published:
11 January 2025

Summary

The Gutenberg Blocks with AI by Kadence WP Page Builder Features plugin for WordPress is susceptible to a stored cross-site scripting vulnerability. This flaw arises from inadequate input sanitization and output escaping processes in the button block link functionality. Authenticated attackers, holding Contributor-level access or greater, can exploit this vulnerability to inject arbitrary web scripts into web pages. These scripts will execute whenever a user visits the compromised page, potentially leading to unauthorized actions and compromise user information.

Affected Version(s)

Gutenberg Blocks with AI by Kadence WP – Page Builder Features * <= 3.4.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3212269/kade...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D.Sim
.