CVE-2024-3344: 
WordPress vulnerability analysis and mitigation

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via SVG file upload in versions up to and including 2.6.8. This vulnerability was discovered and assigned CVE-2024-3344 (NVD).

The vulnerability exists due to insufficient input sanitization and output escaping in the plugin's file upload functionality. The issue specifically affects SVG file uploads, which can be exploited to inject malicious web scripts. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N by NIST, while Wordfence assigned it a score of 6.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When successfully exploited, this vulnerability allows authenticated attackers with author-level access and above to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially compromising the security of site visitors (NVD).

The vulnerability requires an authenticated user with author-level privileges or higher to exploit. The attack vector is through the SVG file upload functionality, making it relatively straightforward to exploit for attackers who meet the authentication requirements (NVD).

The vulnerability has been patched in version 2.6.9 of the Otter Blocks plugin. Users are advised to update to this version or later to protect against this security issue (NVD).