CVE-2024-4042: 
WordPress vulnerability analysis and mitigation

The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (CVE-2024-4042) via the 'class' attribute of the menu-wrap-item block in versions up to and including 2.2.80. This vulnerability was discovered and reported by Wordfence (Wordfence Advisory).

The vulnerability stems from insufficient input sanitization and output escaping in the menu-wrap-item block's 'class' attribute. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (NVD Database).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation of user interactions (NVD Database).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is low, requiring user interaction for successful exploitation (NVD Database).

Users should update to version 2.2.81 or later of the Combo Blocks plugin, which includes a patch for this vulnerability (WordPress Patch).