CVE-2024-4305: 
WordPress vulnerability analysis and mitigation

The Post Grid Gutenberg Blocks and WordPress Blog Plugin (PostX) before version 4.1.0 contains a stored Cross-Site Scripting vulnerability. The plugin fails to properly validate and escape some of its block options before outputting them back in pages or posts where the block is embedded (WPScan, NVD).

The vulnerability stems from insufficient input validation and output escaping in the plugin's block options. When these options are output in pages or posts where the block is embedded, they are not properly sanitized. The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L (NVD).

This vulnerability allows users with contributor-level access and above to perform Stored Cross-Site Scripting attacks. When successful, these attacks could potentially execute arbitrary web scripts whenever a user accesses an affected page (WPScan).

The vulnerability can be exploited by authenticated users with contributor-level privileges or higher. The attack requires the ability to create or edit posts using the affected plugin's block options (WPScan).

The vulnerability has been fixed in version 4.1.0 of the plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).