Stored Cross-Site Scripting in Bootstrap Blocks for WP Editor Plugin

CVE-2024-12495

Summary

The Bootstrap Blocks for WP Editor plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This flaw exists in the 'gtb-bootstrap/column' block, where inadequate input sanitization and output escaping allow authenticated attackers, with Contributor-level access or higher, to insert arbitrary web scripts. Such scripts execute whenever a user visits a page with the injected content, posing a significant security risk to users accessing affected sites.

References