CVE-2024-2509: 
WordPress vulnerability analysis and mitigation

The Gutenberg Blocks by Kadence Blocks WordPress plugin before version 3.2.26 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability exists because the plugin does not properly validate and escape some of its block options before outputting them back in pages or posts where the block is embedded. The issue was discovered and publicly disclosed on March 15, 2024 (WPScan, CleanTalk Research).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's block options. The CVSS v3.1 base score is 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L as assessed by CISA-ADP (NVD).

This vulnerability allows authenticated users with contributor-level access and above to perform Stored Cross-Site Scripting attacks. When exploited, the malicious scripts are executed whenever users access the compromised page, potentially leading to unauthorized actions being performed in the context of the visiting users (CleanTalk Research).

The vulnerability can be exploited by authenticated users with at least contributor-level privileges. The attacker needs to inject malicious code into a page or post using the affected block options, which will then be stored and executed when other users view the content (WPScan).

Users should update the Gutenberg Blocks by Kadence Blocks plugin to version 3.2.26 or later, which contains the fix for this vulnerability (CleanTalk Research).