CVE-2024-8325: Gutenberg Page Builder Blocks & Ready-Made Patterns Library <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the ‘blocksparerendersocialsharingblock’ function in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8325?
CVE-2024-8325 is classified as a stored cross-site scripting vulnerability.
How do I fix CVE-2024-8325?
To fix CVE-2024-8325, update the Blockspare plugin to version 3.2.5 or higher.
Who is affected by CVE-2024-8325?
CVE-2024-8325 affects users of the Blockspare plugin for WordPress versions prior to 3.2.5.
What are the potential impacts of CVE-2024-8325?
The potential impacts of CVE-2024-8325 include unauthorized script execution and data theft due to stored cross-site scripting.
Is CVE-2024-8325 easy to exploit?
Yes, CVE-2024-8325 can be exploited easily if the affected plugin is not updated.