CVE-2024-1999

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget's anchor style parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-20005.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigation_dots' parameter of the Multi ScCVE-2024-200016.7In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SysteCVE-2024-200026.7In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with SysteCVE-2024-200037.5In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent CVE-2024-200047.5In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent CVE-2024-200058.2In da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with SystemCVE-2024-200066.7In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System eCVE-2024-200077.5In mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation of privilege with no aCVE-2024-200098.8In alac decoder, there is a possible out of bounds write due to an incorrect error handling. This could lead to remote escalation of privileCVE-2024-20015.4A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload CVE-2024-200106.7In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with SystCVE-2024-200119.8In alac decoder, there is a possible information disclosure due to an incorrect bounds check. This could lead to remote code execution with
CVE-2024-1999: Medium severity, CVSS 5.4 | Vulnix