CVE-2024-2509

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Gutenberg Blocks by Kadence Blocks	< 3.2.26
wpdownloadmanager	gutenberg_blocks_for_wordpress_download_manager	< 3.2.26

References

https://research.cleantalk.org/cve-2024-2509/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/Exploit, Third Party Advisory
https://research.cleantalk.org/cve-2024-2509/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/dec4a632-e04b-4fdd-86e4-48304b892a4f/Exploit, Third Party Advisory

Timeline

Published: Apr 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-250905.4Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all ver CVE-2024-250919.1Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feat CVE-2024-250928.8Missing Authorization vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.17.0.CVE-2024-250936.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Rating System allows CVE-2024-250945.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Jura & Nicolas Montigny PJ News T CVE-2024-250957.5Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Ma CVE-2024-250969.8Improper Control of Generation of Code ('Code Injection') vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: CVE-2024-250975.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode LLC TNC PDF viewer allows S CVE-2024-250985.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Bajorat PB oEmbed HTML5 Audio –CVE-2024-250995.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David de Boer Paytium: Mollie payment CVE-2024-251009.8Deserialization of Untrusted Data vulnerability in WP Swings Coupon Referral Program allows Object Injection.This issue affects Coupon Refer CVE-2024-251014.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Maspik – Spam Blacklist allows