Stored XSS Vulnerability in SKT Blocks - Gutenberg based Page Builder
CVE-2024-48036

6.5MEDIUM

Key Information:

Vendor
WordPress
Status
Skt Blocks – Gutenberg Based Page Builder
Vendor
CVE Published:
17 October 2024

Summary

A vulnerability exists in SKT Themes' SKT Blocks – Gutenberg based Page Builder that allows for stored Cross-site Scripting (XSS). This issue arises from improper neutralization of user input during web page generation, which can lead to malicious code injection in webpages. Attackers exploiting this vulnerability can perform actions such as stealing cookies, session tokens, or other sensitive information from users. The affected versions range from an unspecified version up to 1.6, highlighting the need for web admins using this plugin to be vigilant and apply necessary patches to mitigate potential risks.

Affected Version(s)

SKT Blocks – Gutenberg based Page Builder <= 1.6

References

https://patchstack.com/database/vulnerability/skt-blocks/...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro Soares de Alcântara - Kinorth (Patchstack Alliance)
.