Stored Cross-Site Scripting in Essential Blocks for WordPress
CVE-2024-13803

6.4MEDIUM

Key Information:

Vendor
WPdevteam
Status
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Vendor
CVE Published:
26 February 2025

Summary

The Essential Blocks plugin, used for creating pages in WordPress, suffers from a Stored Cross-Site Scripting vulnerability. This flaw resides in the 'data-marker' parameter and affects all versions up to 5.2.3. It arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Contributor-level access and above to inject malicious scripts. These scripts can execute whenever an unsuspecting user accesses the compromised page, potentially compromising user data and site integrity.

Affected Version(s)

Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates * <= 5.2.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
http://localhost:1337/wp-content/plugins/essential-blocks...
https://plugins.trac.wordpress.org/changeset/3242493/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D.Sim
.