WordPress Shortcodes Blocks Creator Ultimate plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2024-54264

7.1HIGH

Key Information:

Vendor
WordPress
Status
Shortcodes Blocks Creator Ultimate
Vendor
CVE Published:
13 December 2024

Summary

A vulnerability exists in the Shortcodes Blocks Creator Ultimate plugin developed by César Morillas, allowing for improper neutralization of input during web page generation. This results in a Reflected Cross-site Scripting (XSS) vulnerability, where an attacker can inject malicious scripts into web pages viewed by victims. Affected versions range from earlier releases up to 2.2.0, making it imperative for users to assess their installations and apply necessary security measures to mitigate potential attacks. Regular updates and security practices can help protect against this vulnerability.

Affected Version(s)

Shortcodes Blocks Creator Ultimate <= 2.2.0

References

https://patchstack.com/database/wordpress/plugin/ultimate...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO (Patchstack Alliance)
.