The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts (like those with the contributor role) to conduct Stored XSS attacks.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| — | Genesis Blocks | ≤ 3.1.3 | |
| wpengine | genesis blocks | < 3.1.4 |
cpe:2.3:a:wpengine:genesis_blocks:*:*:*:*:*:wordpress:*:* < 3.1.4Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.