CVE-2024-13465: aBlocks – WordPress Gutenberg Blocks <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Table Of Content" Block, specifically in the "markerView" attribute, in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13465?
CVE-2024-13465 is classified as a high severity vulnerability due to its potential for stored cross-site scripting.
How do I fix CVE-2024-13465?
To fix CVE-2024-13465, update the aBlocks – WordPress Gutenberg Blocks plugin to version 1.6.2 or later.
What versions of the aBlocks plugin are affected by CVE-2024-13465?
CVE-2024-13465 affects all versions of the aBlocks – WordPress Gutenberg Blocks plugin up to and including version 1.6.1.
What type of attack does CVE-2024-13465 enable?
CVE-2024-13465 enables stored cross-site scripting (XSS) attacks through the 'Table Of Content' Block's 'markerView' attribute.
What should I do if I am using an affected version of the aBlocks plugin?
If you are using an affected version of the aBlocks plugin, it is critical to update to a patched version immediately to mitigate the vulnerability.