Themes Vulnerabilities

Blocksy < 2.0.47 - Contributor+ Stored XSS

Description

The theme is vulnerable to Stored Cross-Site Scripting via the ‘has_field_link_rel’ parameter due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Themes

blocksy
Fixed in 2.0.47

References

CVE
CVE-2024-4943
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/dc7099d7-94fd-42be-a921-bfcad43ae252

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Ngô Thiên An (ancorn_)
Verified
No
WPVDB ID
e8cdd4a9-af54-4a0a-8d2b-0d5842751256

Timeline

Publicly Published
2024-05-20 (about 1 year ago)
Added
2024-05-21 (about 1 year ago)
Last Updated
2024-05-21 (about 1 year ago)

Other

Published
Title
Published
2022-11-11
Title
Broken Link Checker < 1.11.20 - Admin+ Cross-Site Scripting
Published
2026-02-13
Title
Press3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block
Published
2021-11-30
Title
LiteSpeed Cache < 4.4.4 - Admin+ Reflected Cross-Site Scripting
Published
2024-12-02
Title
CMSMasters Elementor Addon < 1.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2024-04-25
Title
XStore < 9.3.9 - Reflected Cross-Site Scripting