Twentig Supercharged Block Editor Blocks Patterns Starter Sites Portfolio
Monthly
Stored cross-site scripting (XSS) in Twentig Supercharged Block Editor plugin for WordPress versions up to 1.9.7 allows authenticated attackers with Contributor-level or higher privileges to inject arbitrary JavaScript via the 'featuredImageSizeWidth' parameter, which executes in the browsers of all users who view affected pages. The vulnerability stems from insufficient input sanitization and output escaping. No public exploit code or active exploitation has been confirmed at the time of analysis.
Stored cross-site scripting (XSS) in Twentig Supercharged Block Editor plugin for WordPress versions up to 1.9.7 allows authenticated attackers with Contributor-level or higher privileges to inject arbitrary JavaScript via the 'featuredImageSizeWidth' parameter, which executes in the browsers of all users who view affected pages. The vulnerability stems from insufficient input sanitization and output escaping. No public exploit code or active exploitation has been confirmed at the time of analysis.