WordPress Plugin Vulnerabilities

Spectra < 2.13.1 - Author+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the ‘block_id’ parameter due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
ultimate-addons-for-gutenberg
Fixed in 2.13.1

References

CVE
CVE-2024-4366
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/72a74483-e159-4c51-a9e0-4a128cbf72dd

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Ngô Thiên An (ancorn_)
Verified
No
WPVDB ID
9d63885a-7388-4cba-9b58-db67ecc4c91d

Timeline

Publicly Published
2024-05-23 (about 2 years ago)
Added
2024-05-24 (about 2 years ago)
Last Updated
2024-05-24 (about 2 years ago)

Other

Published
Title
Published
2025-02-24
Title
Table of Contents Block <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-01-15
Title
Realtyna Provisioning < 1.2.3 - Reflected Cross-Site Scripting
Published
2024-07-01
Title
Media Library Assistant < 3.18 - Reflected Cross-Site Scripting
Published
2025-12-05
Title
Yet Another WebClap for WordPress <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2015-01-14
Title
Simple Security <= 1.1.5 - 2 x Cross-Site Scripting (XSS)