CVE-2024-5289: Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget
First published: Thu Jun 27 2024(Updated: )
The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget parameters in all versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| KadenceWP Gutenberg Blocks with AI | <3.2.43 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f9c0ad1e-380e-4b67-b07e-70bf44e4e614?source=cve
- https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.2.38/includes/blocks/class-kadence-blocks-googlemaps-block.php#L226
- https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.2.42/includes/blocks/class-kadence-blocks-googlemaps-block.php#L237
Frequently Asked Questions
What is the severity of CVE-2024-5289?
CVE-2024-5289 has a severity rating that indicates a moderate risk due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-5289?
To fix CVE-2024-5289, update the Kadence WP Gutenberg Blocks with AI plugin to version 3.2.43 or higher.
What versions are affected by CVE-2024-5289?
All versions of the Kadence WP Gutenberg Blocks with AI plugin up to and including 3.2.42 are affected by CVE-2024-5289.
What type of attack is CVE-2024-5289 associated with?
CVE-2024-5289 is associated with Stored Cross-Site Scripting (XSS) attacks through Google Maps widget parameters.
What causes the vulnerability in CVE-2024-5289?
The vulnerability in CVE-2024-5289 is caused by insufficient input sanitization and output escaping.
- agent/title
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- agent/event
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/kadencewp
- canonical/kadencewp gutenberg blocks with ai