CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gutentor Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor allows Stored XSS.This issue affects Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor: from n/a through 3.3.5.
Explanation of Vulnerability in Simple Terms
Gutentor versions up to 3.3.5 contain a stored cross-site scripting (XSS) vulnerability in the page builder. An authenticated user with low privileges can inject malicious scripts into page content. When other users view the affected page, the scripts execute in their browsers, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on their behalf. The vulnerability requires user interaction (visiting the compromised page) and affects the scope beyond the vulnerable component.
What an attacker can do
Inject malicious scripts that execute when other users view pages built with the vulnerable plugin.
Potential impact on your site
Visitors to pages built with Gutentor may have their sessions hijacked or see malicious content injected into the page.
Conditions required to exploit
Attacker needs a low-privilege WordPress account and must trick a user into viewing a page containing the injected script.
Key dates
External resources
Related vulnerabilities
