CVE-2024-2841

CVE-2024-2841 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress, affecting all versions up to and including 2.6.5. This flaw stems from insufficient input sanitization and output escaping, specifically with user-supplied attributes like 'id'. Authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages, which then execute when a user views the compromised page. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low impact to confidentiality and integrity. While it allows for arbitrary script execution, the need for authenticated access and user interaction mitigates its immediate severity. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered minimal community discussion and media coverage, suggesting a low level of public awareness and attention at this time.