CVE-2024-2841: 
WordPress vulnerability analysis and mitigation

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress has been identified with a Stored Cross-Site Scripting vulnerability (CVE-2024-2841). The vulnerability affects all versions up to and including 2.6.5 of the plugin. This security issue was discovered and reported by Wordfence, with the CVE being assigned on March 22, 2024 (CVE Mitre).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes, particularly the 'id' attribute in the plugin's widgets. The vulnerability has been assigned a CVSS v3.1 score with the following vector: AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating a network-accessible vulnerability with low attack complexity requiring low privileges (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation (Wordfence).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack can be executed through the plugin's widgets by manipulating user-supplied attributes (NVD).

A fix has been implemented as evidenced by the WordPress plugin repository changes (WordPress Plugin). Users are advised to update their Otter Blocks plugin to the latest version available.