Lucene search
HistoryJul 11, 2024 - 6:15 a.m.
CVE-2024-4655
wordpress plugin
stored xss
ultimate blocks
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0
Percentile
14.3%
The Ultimate Blocks WordPress plugin before 3.1.9 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected configurations
Node
dotcampultimate_blocksRange<3.1.9wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| dotcamp | ultimate_blocks | * | cpe:2.3:a:dotcamp:ultimate_blocks:*:*:*:*:*:wordpress:*:* |
Related
vulnrichment
vulnrichment
CVE-2024-4655 Ultimate Blocks < 3.1.9 - Contributor+ Stored XSS
2024-07-11 06:00:02
cvelist
cvelist
CVE-2024-4655 Ultimate Blocks < 3.1.9 - Contributor+ Stored XSS
2024-07-11 06:00:02
cve
cve
CVE-2024-4655
2024-07-11 06:15:02
wordfence
wordfence
CVSS3
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0
Percentile
14.3%
Related for NVD:CVE-2024-4655