CVE-2024-9372: 
WordPress vulnerability analysis and mitigation

The WP Blocks Hub WordPress plugin contains a Stored Cross-Site Scripting vulnerability (CVE-2024-9372) that affects all versions up to and including 1.0.2. The vulnerability was discovered and disclosed on October 3, 2024, and the plugin has been closed since October 2, 2024, due to security issues (NVD, WordPress Plugin).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's SVG file upload functionality. This security flaw has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NVD with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Wordfence assessed it with a slightly higher score of 6.4 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When exploited, this vulnerability allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the affected SVG file, potentially compromising the security of site visitors (NVD).

As the plugin has been closed due to security issues since October 2, 2024, the recommended mitigation is to immediately remove the WP Blocks Hub plugin from WordPress installations (WordPress Plugin).