CVE-2024-9372

🗓️ 04 Oct 2024 05:15:13Reported by [email protected]Type

The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-9372	4 Oct 202407:40	–	circl
CNNVD	WordPress plugin WP Blocks Hub 跨站脚本漏洞	4 Oct 202400:00	–	cnnvd
CVE	CVE-2024-9372	4 Oct 202402:04	–	cve
Cvelist	CVE-2024-9372 WP Blocks Hub <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	4 Oct 202402:04	–	cvelist
EUVD	EUVD-2024-49890	3 Oct 202520:07	–	euvd
OSV	CVE-2024-9372	4 Oct 202405:15	–	osv
Patchstack	WordPress WP Blocks Hub plugin <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability	4 Oct 202401:18	–	patchstack
Patchstack	WordPress WP Blocks Hub Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)	4 Oct 202400:00	–	patchstack
Positive Technologies	PT-2024-39600 · WordPress · Wp Blocks Hub	3 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-9372	23 May 202510:38	–	redhatcve