CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PootlePress Caxton – Create Pro page layouts in Gutenberg allows Stored XSS.This issue affects Caxton – Create Pro page layouts in Gutenberg: from n/a through 1.30.1.
Explanation of Vulnerability in Simple Terms
Caxton allows authenticated users to inject malicious scripts into page layouts via Gutenberg editor fields. An attacker with low-level WordPress access can craft a payload that executes in other users' browsers when they view the affected page. The vulnerability requires user interaction (victim must view the page) and can affect site visitors across the platform.
What an attacker can do
Inject JavaScript that runs in other users' browsers to steal data, modify page content, or perform actions on their behalf.
Potential impact on your site
Authenticated attackers can deface pages or steal admin/user session data. Scope is changed, so impact extends beyond the plugin to the broader site.
Conditions required to exploit
Attacker needs a low-privilege WordPress account (e.g., contributor or editor role) and the victim must view the affected page.
Key dates
External resources
Related vulnerabilities
