Skip to content
Sign in
5.4 Medium

CVE-2024-5417 The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting…

Description

The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected products and versions

Product Affected versions Fixed in
Gutentor 3.3 earliest → < 3.3.6 3.3.6
gutenberg_blocks 3.3 earliest → < 3.3.6 3.3.6

Other CVEs of Gutentor

The 3 CVEs of Gutentor →
CVE-2026-16983 The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints,… 4.3 Medium CVE-2025-1986 The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement,… 4.1 Medium
Track this CVE