ghsa-v7vw-qwr3-vgr4
Vulnerability from github
Published
2024-10-12 09:30
Modified
2024-10-12 09:30
Severity ?
Details
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration such as admin nonces with limited impact. These nonces could be used to perform CSRF attacks within a limited time window. The presence of other plugins may make additional nonces available, which may pose a risk in plugins that don't perform capability checks to protect AJAX actions or other actions reachable by lower-privileged users.
{ "affected": [], "aliases": [ "CVE-2024-8760" ], "database_specific": { "cwe_ids": [ "CWE-94" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-12T09:15:02Z", "severity": "MODERATE" }, "details": "The Stackable \u2013 Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration such as admin nonces with limited impact. These nonces could be used to perform CSRF attacks within a limited time window. The presence of other plugins may make additional nonces available, which may pose a risk in plugins that don\u0027t perform capability checks to protect AJAX actions or other actions reachable by lower-privileged users.", "id": "GHSA-v7vw-qwr3-vgr4", "modified": "2024-10-12T09:30:30Z", "published": "2024-10-12T09:30:30Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8760" }, { "type": "WEB", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3158674%40stackable-ultimate-gutenberg-blocks%2Ftrunk\u0026old=3156448%40stackable-ultimate-gutenberg-blocks%2Ftrunk\u0026sfp_email=\u0026sfph_mail=" }, { "type": "WEB", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd0b13c-7447-45da-9608-80b7629d9bbf?source=cve" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.