WordPress Plugin Vulnerabilities

Gutenberg < 14.3.1 - Multiple Stored XSS

Description

The plugin does not escape data from some blocks before outputting ti back in pages, which could lead to Stored XSS issues.

Affected blocks: Search, Feature Image, RSS and Widget

Affects Plugins

Plugin icon
gutenberg
Fixed in 14.3.1

References

URL
https://github.com/WordPress/gutenberg/pull/45045

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.4 (low)

Miscellaneous

Verified
Yes
WPVDB ID
17d969e8-058e-4679-8594-bae605341fb8

Timeline

Publicly Published
2022-10-17 (about 3 years ago)
Added
2022-10-18 (about 3 years ago)
Last Updated
2022-10-18 (about 3 years ago)

Other

Published
Title
Published
2022-12-02
Title
Chained Quiz < 1.3.2.3 - Reflected Cross-Site Scripting
Published
2025-11-24
Title
Just Highlight <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Setting
Published
2021-09-15
Title
PlanSo Forms <= 2.6.3 - Authenticated Stored Cross-Site Scripting
Published
2026-01-13
Title
Kunze Law <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-08-26
Title
Classic Addons – WPBakery Page Builder < 3.6 - Contributor+ Stored XSS