CVE-2024-3901: Genesis Blocks <= 3.1.3 - Contributor+ Stored XSS
The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts (like those with the contributor role) to conduct Stored XSS attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3901?
CVE-2024-3901 has been classified as a medium severity vulnerability due to the potential for Stored XSS attacks.
How do I fix CVE-2024-3901?
To fix CVE-2024-3901, update the Genesis Blocks WordPress plugin to version 3.1.4 or later.
Who is affected by CVE-2024-3901?
Users with the contributor role and those able to write posts on sites using Genesis Blocks plugin version 3.1.3 or earlier are affected by CVE-2024-3901.
What type of attack can CVE-2024-3901 enable?
CVE-2024-3901 enables Stored XSS attacks, allowing malicious scripts to be executed when users view affected posts.
What does it mean that CVE-2024-3901 affects custom blocks?
The vulnerability means that the improper escaping of attributes in custom blocks could be exploited to inject harmful scripts.