A recently disclosed vulnerability in Page Builder for Gutenberg Editor has raised concerns among website administrators and developers .
See also: WordPress: Critical vulnerabilities in Spam protection, Anti-Spam, FireWall plugin
The WordPress Gutenberg Editor vulnerability, identified as CVE-2024-10178, allows attackers with access or higher to inject malicious scripts into web pages via the plugin's Countdown widget. This vulnerability affects all versions of the plugin up to and including 3.3.9.
The issue is due to insufficient input sanitization and output escaping in user-supplied attributes in the Countdown widget.
See also: Vulnerability in WordPress Plugin exposes websites to hackers
This improper handling allows attackers to perform Cross-Site Scripting (XSS). Once a malicious script, it is executed every time a user accesses the compromised page, potentially leading to data theft, session hijacking, or other harmful actions.
Researchers at Wordfence found that the vulnerability is classified as moderate severity with a CVSS score of 6.4, reflecting its potential impact and ease of exploitation.
Notably, the attack requires no user interaction beyond accessing an affected page, making it particularly worrisome for administrators of multi-user WordPress sites.
XSS flaws like this highlight the importance of secure coding practices, particularly regarding input validation and output escaping.
See also: WordPress: New serious vulnerability in LiteSpeed Cache plugin
Cross-Site Scripting (XSS) is one of the most widespread security threats on the internet. Attackers exploit XSS flaws to encourage a website to execute malicious JavaScript in a user's browser. This can lead to the theft of personal information, such as passwords or credit cards, and the user taking unwanted actions.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
