CVE-2021-24751: GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site Scripting
Published Nov 29, 2021
·Updated
The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Affected Software
1 affected component
GenerateBlocks GenerateBlocks WordPress<1.4.0
Event History
Nov 29, 2021
CVE Published
via MITRE·08:25 AM
Data Sourced
via MITRE·08:25 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-24751?
CVE-2021-24751 has a medium severity rating due to its potential to allow Cross-Site Scripting attacks.
2
How do I fix CVE-2021-24751?
To fix CVE-2021-24751, update the GenerateBlocks WordPress plugin to version 1.4.0 or later.
3
Who is affected by CVE-2021-24751?
Users with roles as low as contributor are affected by CVE-2021-24751 and can exploit this vulnerability.
4
What type of vulnerability is CVE-2021-24751?
CVE-2021-24751 is classified as a Cross-Site Scripting (XSS) vulnerability.
5
What software versions are vulnerable to CVE-2021-24751?
Versions of the GenerateBlocks plugin prior to 1.4.0 are vulnerable to CVE-2021-24751.