The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor privileges to conduct Stored XSS attacks.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/e092ccdc-7ea1-4937-97b7-4cdbff5e74e5/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/e092ccdc-7ea1-4937-97b7-4cdbff5e74e5/ | Exploit Third Party Advisory |
Configurations
History
30 May 2025, 16:00
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| First Time |
Wpengine
Wpengine genesis Blocks |
|
| References | () https://wpscan.com/vulnerability/e092ccdc-7ea1-4937-97b7-4cdbff5e74e5/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:wpengine:genesis_blocks:*:*:*:*:*:wordpress:*:* |
19 Apr 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-19 05:15
Updated : 2025-05-30 16:00
NVD link : CVE-2024-2761
Mitre link : CVE-2024-2761
JSON object : View
Products Affected
wpengine
- genesis_blocks
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
