Cloud Blocks WordPress plugin unauthenticated stored XSS
Anyone can plant suspicious content in this WordPress block plugin to hit admins.
Summary
The Cloud Blocks WordPress plugin does not check authorisation or sanitise input when storing block asset URLs. Unauthenticated users can store malicious scripts that run in the browser of any administrator who opens the block editor. Versions through 1.1.8 are affected.
What to do
No fixed version is listed yet. Check that the plugin runs a version newer than 1.1.8, and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
Times
First published
First seen