WordPress Plugin Vulnerabilities

Gutenberg PDF Viewer Block < 1.0.1 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does not sanitise and escape its block, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
pdf-viewer-block
Fixed in 1.0.1

References

CVE
CVE-2021-24760

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
WPVDB ID
aebf821f-1724-4e4c-8d42-5a94e509d271

Timeline

Publicly Published
2021-09-20 (about 4 years ago)
Added
2021-09-20 (about 4 years ago)
Last Updated
2022-04-08 (about 3 years ago)

Other

Published
Title
Published
2024-09-16
Title
AVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG Uplaod
Published
2025-03-24
Title
Include URL <= 0.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-10-31
Title
Appointment booking addon for Gravity Forms <= 1.9.5.1 - Admin+ Stored XSS
Published
2015-08-05
Title
WordPress <= 4.2.3 - Legacy Theme Preview Cross-Site Scripting (XSS)
Published
2024-09-30
Title
WP-WebAuthn < 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting