CVE-2024-3563: Genesis Blocks <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes
The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-3901 is a duplicate of this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3563?
CVE-2024-3563 has been classified as a medium severity vulnerability affecting the Genesis Blocks plugin for WordPress.
How do I fix CVE-2024-3563?
To fix CVE-2024-3563, update the Genesis Blocks plugin to version 3.1.4 or later.
Who is affected by CVE-2024-3563?
CVE-2024-3563 affects all versions of the Genesis Blocks plugin for WordPress up to and including 3.1.3.
What type of vulnerability is CVE-2024-3563?
CVE-2024-3563 is a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping.
Can CVE-2024-3563 be exploited by unauthenticated users?
Yes, CVE-2024-3563 can potentially be exploited by authenticated users with permission to use the Sharing block.