Stored Cross-Site Scripting in SlingBlocks Plugin for WordPress
CVE-2024-13675
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 8 March 2025
What is CVE-2024-13675?
The SlingBlocks – Gutenberg Blocks by FunnelKit plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability that arises from inadequate input sanitization and output escaping in the 'Icon List' Block. This flaw permits authenticated attackers with Contributor-level access or higher to execute arbitrary scripts on user-accessed pages, compromising the integrity and safety of the site.
Affected Version(s)
SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) * <= 1.5.0