CVE-2024-4305

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-430507.8Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.CVE-2024-430515.5Information disclosure while deriving keys for a session for any Widevine use case.CVE-2024-430527.8Memory corruption while processing API calls to NPU with invalid input.CVE-2024-430537.8Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.CVE-2024-430557.8Memory corruption while processing camera use case IOCTL call.CVE-2024-430566.5Transient DOS during hypervisor virtual I/O operation in a virtual machine.CVE-2024-430577.8Memory corruption while processing command in Glink linux.CVE-2024-430587.8Memory corruption while processing IOCTL calls.CVE-2024-430597.8Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.CVE-2024-43068.8Critical unrestricted file upload vulnerability in HubBank affecting version 1.0.2. This vulnerability allows a registered user to upload ma CVE-2024-430607.8Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.CVE-2024-430617.8Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in H