The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://research.cleantalk.org/cve-2024-2509/ | Third Party Advisory Exploit |
| https://research.cleantalk.org/cve-2024-2509/ | Third Party Advisory Exploit |
| https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/ | Exploit Third Party Advisory |
Configurations
History
13 May 2025, 00:41
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| References | () https://research.cleantalk.org/cve-2024-2509/ - Third Party Advisory, Exploit | |
| References | () https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:kadencewp:gutenberg_blocks_with_ai:*:*:*:*:*:wordpress:*:* | |
| First Time |
Kadencewp
Kadencewp gutenberg Blocks With Ai |
08 Apr 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |
| References |
|
05 Apr 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-05 05:15
Updated : 2025-05-13 00:41
NVD link : CVE-2024-2509
Mitre link : CVE-2024-2509
JSON object : View
Products Affected
kadencewp
- gutenberg_blocks_with_ai
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')