Medium severity · published Aug 29, 2024
CVE-2024-7132
CoBlocks < 3.1.13 - Editor+ Stored XSS
4.8
CVSS
0.4%
EPSS
No
On KEV
Description
The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with the capability to publish posts (editor and admin by default) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PB
Page Builder Gutenberg Blocks ·
before 3.1.13 · source: vendor
CO
Coblocks · Godaddy
before 3.1.13 · source: NVD
GB
Gutenberg Blocks · Gutentor
before 3.1.13 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7132
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7132
Exploit
https://wpscan.com/vulnerability/16deb743-6fe9-43a2-9586-d92cfe1daa17/
More from Page Builder Gutenberg Blocks
6.5
CVE-2024-4260
CoBlocks < 3.1.12 - Contributor+ SSRF
5.4
CVE-2024-2369
Page Builder Gutenberg Blocks < 3.1.7 - Contributor+ Stored XSS