Master Blocks
Monthly
Unauthenticated REST API abuse in the Master Blocks WordPress plugin (versions 1.4.1 up to but not including 1.5.0) lets any network attacker silently rewrite the plugin's settings, because one of its REST routes is registered without an authorization or permission callback. One of those attacker-controllable settings is later emitted unescaped in the WordPress admin area, so the injected value becomes stored XSS that executes in the browser session of any administrator who visits an affected wp-admin page. Publicly available exploit code exists, and there is no confirmed active exploitation (CISA KEV) at time of analysis; the independent assessment raises the scope to Changed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, vendor score 8.8), reflecting that the impact escapes the plugin and lands inside the administrator's WordPress session.
Unauthenticated REST API abuse in the Master Blocks WordPress plugin (versions 1.4.1 up to but not including 1.5.0) lets any network attacker silently rewrite the plugin's settings, because one of its REST routes is registered without an authorization or permission callback. One of those attacker-controllable settings is later emitted unescaped in the WordPress admin area, so the injected value becomes stored XSS that executes in the browser session of any administrator who visits an affected wp-admin page. Publicly available exploit code exists, and there is no confirmed active exploitation (CISA KEV) at time of analysis; the independent assessment raises the scope to Changed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, vendor score 8.8), reflecting that the impact escapes the plugin and lands inside the administrator's WordPress session.