CVE-2024-1541

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htmlTag attribute in all versions up to, and including, 3.2.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-15435.5The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line re CVE-2024-15444.9Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the or CVE-2024-15458.8Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allow CVE-2024-15467.5When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memo CVE-2024-15476.5Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the vict CVE-2024-15484.3A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion an CVE-2024-15496.1If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in us CVE-2024-15506.1A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-pos CVE-2024-15516.1Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type respon CVE-2024-15527.5Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects CVE-2024-15538.1Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption CVE-2024-15549.8The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may cont