MAL-2024-7960 Malicious code in gutenberg-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6854fac965adb45298fefad26e9d2c828ec68a13c8658fd41ef9d095fd2eaff6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Post Grid and Gutenberg Blocks Plugin <= 2.2.86 is vulnerable to Cross Site Scripting (XSS)

Software Post Grid and Gutenberg Blocks Type Plugin Vulnerable versions = 2.2.86 Fixed in 2.2.87 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43155 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f0cac3f4c4dc Credits 4rCanJ0x! Required...

WordPress Essential Blocks plugin < 4.7.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Essential Blocks for Gutenberg versions 4.7.0...

WordPress Essential Blocks for Gutenberg Plugin < 4.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Essential Blocks for Gutenberg Type Plugin Vulnerable versions 4.7.0 Fixed in 4.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5595 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 76492ed10683 Credits Dmitrii...

CVE-2024-6346

The CVE-2024-6346 entry concerns the WordPress plugins Post Grid, Gutenberg Blocks, and Combo Blocks (up to 2.2.85a). The vulnerability is a Stored Cross-Site Scripting (XSS) via the redirectURL parameter of the Date Countdown widget, caused by insufficient input sanitization and output escaping ...

WordPress Post Grid and Gutenberg Blocks Plugin <= 2.2.85a is vulnerable to Cross Site Scripting (XSS)

Software Post Grid and Gutenberg Blocks Type Plugin Vulnerable versions = 2.2.85a Fixed in 2.2.86 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6346 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0a3eb3d1bba0 Credits...

PT-2024-37555 · WordPress · Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress versions up to, and including, 2.2.85a Description: The issue is related to Stored Cross-Site Scripting via the redirectURL parameter of the Date Countdown widget, due to...

VulnCheck KEV: CVE-2022-24665

PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts...

CVE-2024-4260

The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks...

CVE-2024-4260

CVE-2024-4260 concerns the WordPress plugin Page Builder Gutenberg Blocks (CoBlocks) , prior to version 3.1.12. The issue arises from the plugin not restricting pinging to arbitrary hosts via some of its shortcodes, potentially enabling a high-privilege user (e.g., a Contributor) to perform an SS...

PT-2024-30054 · WordPress · Page Builder Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: The Page Builder Gutenberg Blocks WordPress plugin versions prior to 3.1.12 Description: The issue allows high privilege users, such as contributors, to perform Server-Side Request Forgery SSRF attacks by pinging arbitrary hosts via some of i...

WordPress Getwid – Gutenberg Blocks Plugin <= 2.0.10 is vulnerable to Broken Access Control

Software Getwid – Gutenberg Blocks Type Plugin Vulnerable versions = 2.0.10 Fixed in 2.0.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-6491 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 17de91b96aed Credits Peter Thaleikis...

CVE-2024-37457

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks – Gutenberg Blocks Plugin allows Stored XSS.This issue affects Ultimate Blocks – Gutenberg Blocks Plugin: from n/a through 3.1.9...

CVE-2024-37492

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Gutenberg Team Gutenberg allows Stored XSS.This issue affects Gutenberg: from n/a through 18.6.0...

CVE-2024-37492

CVE-2024-37492 affects the WordPress Gutenberg plugin (versions through 18.6.0). The vulnerability is an Improper Neutralization of Input During Web Page Generation (XSS) that yields a stored XSS condition in Gutenberg outputs. Root cause is input handling in the plugin’s page generation code. Im...

CVE-2024-37519 WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.1.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Leap13 Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through = 2.1.27...

CVE-2024-37519

The CVE-2024-37519 entry concerns Leap13 Premium Blocks – Gutenberg Blocks for WordPress (Premium Blocks) with a Stored XSS vulnerability due to improper neutralization of input during web page generation. Affected versions: 2.1.27 and earlier. The issue is a Cross Site Scripting vulnerability in...

PT-2024-27600 · WordPress · Gutenberg

Name of the Vulnerable Software and Affected Versions: Gutenberg versions through 18.6.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For versions...

PT-2024-27568 · WordPress · Ultimate Blocks – Gutenberg Blocks Plugin

Name of the Vulnerable Software and Affected Versions: Ultimate Blocks – Gutenberg Blocks Plugin versions 3.1.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in the...

CVE-2024-37951

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Noor alam Magical Posts Display – Elementor & Gutenberg Posts Blocks allows Stored XSS.This issue affects Magical Posts Display – Elementor & Gutenberg Posts Blocks: from n/a through 1.2.38...