Stored Cross-Site Scripting Vulnerability Affects Kadence WP Plugin
CVE-2024-9655
5.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 1 November 2024
What is CVE-2024-9655?
The Gutenberg Blocks with AI plugin, developed by Kadence WP for WordPress, is susceptible to Stored Cross-Site Scripting (XSS) attacks through its Icon widget. This vulnerability arises from inadequate input sanitization and output escaping for user-provided attributes, allowing authenticated attackers with contributor-level access and above to inject malicious web scripts. These scripts can execute when users access the affected pages, posing significant risks to website integrity and user safety.
Affected Version(s)
Gutenberg Blocks with AI by Kadence WP – Page Builder Features * <= 3.3.1