Premium Blocks Gutenberg Blocks For Wordpress
Monthly
Stored cross-site scripting in the Premium Blocks - Gutenberg Blocks for WordPress plugin (versions up to and including 2.3.17) lets an authenticated Contributor-level user inject persistent JavaScript into block content that executes when a higher-privileged editor or administrator later views or previews that content in wp-admin. Exploitation requires a foothold account with Contributor privileges and victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 6.5), with low confidentiality and integrity impact and no availability impact; sites that do not accept untrusted author accounts are largely insulated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch version is specified in the available intelligence.
Stored cross-site scripting in the Premium Blocks - Gutenberg Blocks for WordPress plugin (versions up to and including 2.3.17) lets an authenticated Contributor-level user inject persistent JavaScript into block content that executes when a higher-privileged editor or administrator later views or previews that content in wp-admin. Exploitation requires a foothold account with Contributor privileges and victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 6.5), with low confidentiality and integrity impact and no availability impact; sites that do not accept untrusted author accounts are largely insulated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch version is specified in the available intelligence.