CVE-2024-4057: 
WordPress vulnerability analysis and mitigation

The Gutenberg Blocks with AI by Kadence WP WordPress plugin before version 3.2.37 contains a stored Cross-Site Scripting (XSS) vulnerability. The plugin fails to properly validate and escape certain block attributes before outputting them back in a page or post where the block is embedded (WPScan).

The vulnerability exists in the block attributes handling mechanism of the plugin. Users with contributor role or higher privileges can exploit this by manipulating block attributes that are not properly sanitized. The vulnerability has been assigned a CVSS 3.x base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated users with contributor role or higher privileges to perform stored Cross-Site Scripting attacks. The stored XSS payload can be triggered when any user views or previews the affected post and interacts with the manipulated content (WPScan).

A proof of concept exists demonstrating the vulnerability. An attacker can exploit this by adding a Lottie Animation block to a post and inserting a malicious payload in the 'Lottie Animation URL' option. The XSS payload is triggered when users move their mouse over the generated image (WPScan).

The vulnerability has been fixed in version 3.2.37 of the Gutenberg Blocks with AI by Kadence WP plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).