CVE-2024-5289: Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget parameters in all versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5289?
CVE-2024-5289 has a severity rating that indicates a moderate risk due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-5289?
To fix CVE-2024-5289, update the Kadence WP Gutenberg Blocks with AI plugin to version 3.2.43 or higher.
What versions are affected by CVE-2024-5289?
All versions of the Kadence WP Gutenberg Blocks with AI plugin up to and including 3.2.42 are affected by CVE-2024-5289.
What type of attack is CVE-2024-5289 associated with?
CVE-2024-5289 is associated with Stored Cross-Site Scripting (XSS) attacks through Google Maps widget parameters.
What causes the vulnerability in CVE-2024-5289?
The vulnerability in CVE-2024-5289 is caused by insufficient input sanitization and output escaping.