CVE-2024-2729 Otter Blocks < 2.6.6 - Contributor+ Stored XSS

2024-04-1805:00:02

WPScan

www.cve.org

wordpress plugin

stored xss

contributor

security vulnerability

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks’ attribute before appending it to the final rendered block, allowing contributors to conduct Stored XSS attacks.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Otter Blocks ",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "2.6.6"
      }
    ],
    "defaultStatus": "unaffected"
  }
]