Stored Cross-Site Scripting in Essential Blocks for WordPress

CVE-2024-13803

What is CVE-2024-13803?

The Essential Blocks plugin, used for creating pages in WordPress, suffers from a Stored Cross-Site Scripting vulnerability. This flaw resides in the 'data-marker' parameter and affects all versions up to 5.2.3. It arises from inadequate input sanitization and output escaping, allowing authenticated attackers with Contributor-level access and above to inject malicious scripts. These scripts can execute whenever an unsuspecting user accesses the compromised page, potentially compromising user data and site integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References