WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings vulnerability

🗓️ 03 Apr 2024 01:20:29Reported by Akbar KustiramaType

Authenticated editors can trigger stored Cross Site Scripting in Kadence Blocks Gutenberg Blocks up to version 3.2.17 via Contact Form Message Settings.

Reporter	Title	Published	Views	Family All 10
CVE	CVE-2024-0598	9 Apr 202418:59	–	cve
Cvelist	CVE-2024-0598 Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings	9 Apr 202418:59	–	cvelist
EUVD	EUVD-2024-16391	3 Oct 202520:07	–	euvd
NVD	CVE-2024-0598	9 Apr 202419:15	–	nvd
OSV	CVE-2024-0598	9 Apr 202419:15	–	osv
Patchstack	WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.17 is vulnerable to Cross Site Scripting (XSS)	3 Apr 202400:00	–	patchstack
RedhatCVE	CVE-2024-0598	23 May 202507:25	–	redhatcve
Vulnrichment	CVE-2024-0598 Gutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings	9 Apr 202418:59	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (April 1, 2024 to April 7, 2024)	11 Apr 202417:23	–	wordfence
WPVulnDB	Gutenberg Blocks by Kadence Blocks < 3.2.18 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings	4 Apr 202400:00	–	wpvulndb

Vulners

Node

wordpress gutenberg_blocks_by_kadence_blocksRange≤3.2.17

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kadence-blocks/gutenberg-blocks-by-kadence-blocks-3217-authenticatededitor-stored-cross-site-scripting-via-contact-form-message-settings

03 Apr 2024 01:20Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.4 - 4.8

EPSS0.00333

SSVC