Lucene search
Dmitrii IgnatyevWPVDB-ID:5014F886-020E-49D1-96A5-2159EED8BA14HistoryMar 28, 2024 - 12:00 a.m.
Otter Blocks < 2.6.6 - Contributor+ Stored XSS
2024-03-2800:00:00
Dmitrii Ignatyev
wpscan.com
6
otter blocks
plugin
contributor+
stored xss
vulnerability
code editor
Description The plugin does not properly escape its mainHeadings blocks’ attribute before appending it to the final rendered block, allowing contributors to conduct Stored XSS attacks.
PoC
As a contributor, put the following payload in a post while in Code Editor mode The XSS will be triggered when viewing/prevewing the post
| CPE | Name | Operator | Version |
|---|---|---|---|
| eq | 2.6.6 |
References
Related
wpexploit
wpexploit
Otter Blocks < 2.6.6 - Contributor+ Stored XSS
2024-03-28 00:00:00
nvd
nvd
CVE-2024-2729
2024-04-18 05:15:48
cve
cve
CVE-2024-2729
2024-04-18 05:15:48
cvelist
cvelist
CVE-2024-2729 Otter Blocks < 2.6.6 - Contributor+ Stored XSS
2024-04-18 05:00:02
wordfence
wordfence
9 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.2%
Related for WPVDB-ID:5014F886-020E-49D1-96A5-2159EED8BA14