6.3
Medium
CVE-2024-4655 The Ultimate Blocks WordPress plugin before 3.1.9 does not validate and escape some of its block options before…
Description
The Ultimate Blocks WordPress plugin before 3.1.9 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ultimate Blocks 3.1 | earliest → < 3.1.9 | 3.1.9 |
| ultimate_blocks 3.1 | earliest → < 3.1.9 | 3.1.9 |
Other CVEs of Ultimate Blocks
The 5 CVEs of Ultimate Blocks →
CVE-2024-10678
The Ultimate Blocks WordPress plugin before 3.2.4 does not validate and escape some of its block options before…
5.4
Medium
CVE-2024-8536
The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before…
5.4
Medium
CVE-2024-6362
The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes…
4.6
Medium
CVE-2024-3241
The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before…
5.4
Medium