CVE-2024-2729 Otter Blocks < 2.6.6 - Contributor+ Stored XSS

2024-04-1805:00:02

WPScan

github.com

otter blocks wordpress plugin

stored xss attacks

contributor+

AI Score

5.8

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks’ attribute before appending it to the final rendered block, allowing contributors to conduct Stored XSS attacks.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:themeisle:otter_blocks:-:*:*:*:*:*:*:*"
    ],
    "vendor": "themeisle",
    "product": "otter_blocks",
    "versions": [
      {
        "status": "affected",
        "version": "-"
      }
    ],
    "defaultStatus": "unknown"
  }
]