Stored Cross-Site Scripting Vulnerability in Cosmic Blocks Plugin for WordPress

CVE-2024-13674

What is CVE-2024-13674?

The Cosmic Blocks Content Editor Blocks Collection plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the 'cwp_social_share' shortcode. This flaw stems from inadequate input sanitization and output escaping for user-supplied attributes, enabling authenticated users with contributor-level access or higher to inject malicious web scripts into pages. The consequences of this vulnerability can be severe, as it allows injected scripts to execute when other users access the compromised page, creating significant security concerns for affected websites.

References