CVE-2024-4208: 
WordPress vulnerability analysis and mitigation

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-4208) in versions up to and including 3.2.37. The vulnerability exists in the typer effect feature within the advanced heading widget due to insufficient input sanitization and output escaping on user-supplied attributes (NVD).

The vulnerability stems from improper input sanitization and output escaping of user-supplied attributes in the advanced heading widget's typer effect feature. The CVSS v3.1 base score is 5.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N according to NVD's assessment. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring only basic access to the WordPress admin interface to inject malicious scripts through the advanced heading widget (NVD).

Users should upgrade to version 3.2.38 or later of the Gutenberg Blocks with AI by Kadence WP plugin, which contains the fix for this vulnerability (Wordpress Patch).