Stored Cross-Site Scripting Vulnerability in Cosmic Blocks Plugin for WordPress

CVE-2024-13674

What is CVE-2024-13674?

The Cosmic Blocks Content Editor Blocks Collection plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the 'cwp_social_share' shortcode. This flaw stems from inadequate input sanitization and output escaping for user-supplied attributes, enabling authenticated users with contributor-level access or higher to inject malicious web scripts into pages. The consequences of this vulnerability can be severe, as it allows injected scripts to execute when other users access the compromised page, creating significant security concerns for affected websites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References