CVE-2024-2729

2024-04-1805:15:48

WPScan

web.nvd.nist.gov

otter blocks

wordpress

vulnerability

stored xss

cve-2024-2729

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

8.8

Confidence

High

EPSS

Percentile

9.0%

JSON

The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks’ attribute before appending it to the final rendered block, allowing contributors to conduct Stored XSS attacks.

Affected configurations

Vulners

Node

themeisleotterRange<2.6.6wordpress

VendorProductVersionCPE
themeisleotter*cpe:2.3:a:themeisle:otter:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
themeisle	otter	*	cpe:2.3:a:themeisle:otter::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Otter Blocks ",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "2.6.6"
      }
    ],
    "defaultStatus": "unaffected"
  }
]