WordPress Plugin Vulnerabilities

Gutenberg < 16.8.1 - Contributor+ Stored XSS via Navigation Links Block

Description

The plugin does not escape some of its Navigation block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
gutenberg
Fixed in 16.8.1

References

CVE
CVE-2023-38000

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad, Edouard Lamoine
Verified
No
WPVDB ID
4fe72fc6-ccb1-4a33-a249-2c2e7da79c88

Timeline

Publicly Published
2023-10-13 (about 2 years ago)
Added
2023-10-13 (about 2 years ago)
Last Updated
2023-10-13 (about 2 years ago)

Other

Published
Title
Published
2026-02-05
Title
iContact for Gravity Forms <= 1.3.2 - Reflected Cross-Site Scripting
Published
2025-01-07
Title
wp custom countdown <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-01-08
Title
3DVieweronline < 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-04-22
Title
Advanced Floating Content Lite < 1.2.6 - Authenticated (Editor+) Stored Cross-Site Scripting
Published
2023-10-04
Title
Geo Controller < 8.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting