Stored Cross-Site Scripting in Essential Blocks for WordPress
CVE-2024-13803
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 February 2025
What is CVE-2024-13803?
The Essential Blocks plugin, used for creating pages in WordPress, suffers from a Stored Cross-Site Scripting vulnerability. This flaw resides in the 'data-marker' parameter and affects all versions up to 5.2.3. It arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Contributor-level access and above to inject malicious scripts. These scripts can execute whenever an unsuspecting user accesses the compromised page, potentially compromising user data and site integrity.
Affected Version(s)
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates * <= 5.2.3