CVE-2024-2226

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id parameter in the google-map block in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access and higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-20CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 9, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-222606.8VMware Workspace One UEM update addresses an information exposure vulnerability.  A malicious actor with network access to the Workspace OneCVE-2024-222615.5SQL-Injection in Harbor allows priviledge users to leak the task IDsCVE-2024-222628.1Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checkCVE-2024-222638.8Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has CVE-2024-222647.2VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious actor with admin privileges on VMware Avi Load Balancer CVE-2024-222666.5VMware Avi Load Balancer contains an information disclosure vulnerability. A malicious actor with access to the system logs can view cloud cCVE-2024-222678.2VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative pCVE-2024-222686.5VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. A malicious actor with non-administrCVE-2024-222696.0VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. A malicious actor with local adminisCVE-2024-22277.5This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServeCVE-2024-222706.0VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicioCVE-2024-222718.2In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when at