CVE-2024-3818: 
WordPress vulnerability analysis and mitigation

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-3818) in its 'Social Icons' block. The vulnerability affects all versions up to and including 4.5.9, and was discovered on April 18, 2024. The issue stems from insufficient input sanitization and output escaping on user-supplied attributes (NVD).

The vulnerability is classified as a CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 base score of 5.4 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C) with low confidentiality (C:L) and integrity (I:L) impacts, and no availability impact (A:N) (NVD).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions, data theft, or other malicious activities (WPScan).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack can be executed through the plugin's 'Social Icons' block functionality, where malicious scripts can be injected due to improper input validation (Wordfence).

Users should immediately upgrade to version 4.5.10 or later of the Essential Blocks plugin, which contains the security fix for this vulnerability. The patch has been implemented through changes in the social links component (WordPress Patch).