CVE-2024-4891: 
WordPress vulnerability analysis and mitigation

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-4891) discovered in versions up to and including 4.5.12. The vulnerability was identified and disclosed on May 15, 2024, affecting the plugin's handling of the 'tagName' parameter (CVE Mitre).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's handling of the 'tagName' parameter. The issue has been assigned a CVSS score of 6.4 (Medium), indicating a moderate severity level. The vulnerability specifically affects the Advanced Heading functionality within the plugin (Wordfence Intel).

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions or data theft (CVE Mitre).

The vulnerability requires authentication with at least contributor-level access to exploit, which somewhat limits its potential impact. The attack vector involves manipulating the 'tagName' parameter in the Advanced Heading block of the plugin (Wordfence Intel).

Website administrators using the Essential Blocks plugin should update to a version newer than 4.5.12 as soon as possible. The vulnerability has been addressed in subsequent releases through improved input sanitization and output escaping mechanisms (WordPress Plugin).