CVE-2024-4655: 
WordPress vulnerability analysis and mitigation

The Ultimate Blocks WordPress plugin before version 3.1.9 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on June 20, 2024, and was assigned CVE-2024-4655. The plugin fails to properly validate and escape certain block options before outputting them back in pages or posts where the blocks are embedded (WPScan).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 5.4 (Medium) according to NVD, and 6.3 (Medium) according to CISA-ADP. The vulnerability affects users with contributor role and above, allowing them to perform Stored Cross-Site Scripting attacks through unvalidated and unescaped block options (NVD).

Successful exploitation of this vulnerability could allow users with contributor privileges or higher to inject and execute malicious JavaScript code in the context of other users' browsers when they view the affected pages or posts. This could lead to theft of sensitive information, session hijacking, or other client-side attacks (WPScan).

The vulnerability is exploitable by users with contributor-level access or higher. A proof of concept exists demonstrating that an attacker can inject malicious code through the Code Editor mode in a post, which gets triggered when users move their mouse over specific text (WPScan).

The vulnerability has been patched in Ultimate Blocks version 3.1.9. Users are advised to update to this version or later to mitigate the risk (WPScan).