WordPress Plugin Vulnerabilities

Otter Blocks < 2.6.5 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does not validate and escape its id block parameter before outputting it back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin

Affects Plugins

Plugin icon
otter-blocks
Fixed in 2.6.5

References

CVE
CVE-2024-2226
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/217d3148-d411-4fff-a4f6-d5d02ef207af

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Ngô Thiên An (ancorn_)
Verified
No
WPVDB ID
eaa747d5-7009-4896-9659-cb3ef17d9e48

Timeline

Publicly Published
2024-03-13 (about 2 years ago)
Added
2024-03-18 (about 2 years ago)
Last Updated
2024-03-20 (about 2 years ago)

Other

Published
Title
Published
2023-05-19
Title
Custom 404 Pro < 3.8.2 - Reflected XSS
Published
2021-12-02
Title
Customize Login Image < 3.5.3 - Admin+ Stored Cross-Site Scripting
Published
2026-02-21
Title
Toocheke Companion < 1.195 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2017-12-05
Title
Smart Marketing SMS and Newsletters Forms < 2.0.0 - Unauthenticated Cross-Site Scripting (XSS)
Published
2014-08-01
Title
Car Demon 1.0.1 - /wp-admin/post.php Multiple Parameter XSS