The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Metrics
Affected Vendors & Products
References
History
Thu, 10 Oct 2024 21:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Wpblockshub
Wpblockshub wp Blocks Hub |
|
CPEs | cpe:2.3:a:wpblockshub:wp_blocks_hub:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Wpblockshub
Wpblockshub wp Blocks Hub |
Fri, 04 Oct 2024 14:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Fri, 04 Oct 2024 04:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | |
Title | WP Blocks Hub <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload | |
Weaknesses | CWE-79 | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-10-04T02:04:52.036Z
Updated: 2024-10-04T14:00:37.227Z
Reserved: 2024-09-30T20:34:23.070Z
Link: CVE-2024-9372
Vulnrichment
Updated: 2024-10-04T14:00:26.553Z
NVD
Status : Analyzed
Published: 2024-10-04T05:15:13.440
Modified: 2024-10-10T20:36:28.020
Link: CVE-2024-9372
Redhat
No data.