Wordpress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter vulnerability

🗓️ 14 Jun 2024 03:12:20Reported by stealthcopterType

Authenticated contributor can exploit stored cross-site scripting via titleFont in Kadence Blocks plugin up to version 3.2.38.

Reporter	Title	Published	Views	Family All 9
CVE	CVE-2024-4863	14 Jun 202408:35	–	cve
Cvelist	CVE-2024-4863 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter	14 Jun 202408:35	–	cvelist
EUVD	EUVD-2024-44440	3 Oct 202520:07	–	euvd
NVD	CVE-2024-4863	14 Jun 202409:15	–	nvd
Patchstack	WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.38 is vulnerable to Cross Site Scripting (XSS)	14 Jun 202400:00	–	patchstack
RedhatCVE	CVE-2024-4863	23 May 202507:38	–	redhatcve
Vulnrichment	CVE-2024-4863 Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter	14 Jun 202408:35	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (June 10, 2024 to June 16, 2024)	20 Jun 202413:40	–	wordfence
WPVulnDB	Gutenberg Blocks by Kadence Blocks – Page Builder Features < 3.2.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter	13 Jun 202400:00	–	wpvulndb

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kadence-blocks/gutenberg-blocks-by-kadence-blocks-page-builder-features-3238-authenticated-contributor-stored-cross-site-scripting-via-titlefont-parameter

14 Jun 2024 03:12Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.4 - 6.4

EPSS0.00346

SSVC