Lowol Ngo

**Name of the Vulnerable Software and Affected Versions** Content Blocks (Custom Post Widget) plugin for WordPress versions up to, and including, 3.3.5 **Description** The issue is related to Stored Cross-Site Scripting via the `content` parameter within the plugin's shortcode Content Block due to insufficient input sanitization and output escaping. This allows authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 3.3.5, update to a version later than 3.3.5 to resolve the issue. As a temporary workaround, consider restricting access to the `content` parameter within the plugin's shortcode Content Block to minimize the risk of exploitation. Additionally, restrict Contributor-level access and above to reduce the potential attack surface.

**Name of the Vulnerable Software and Affected Versions** Content Blocks (Custom Post Widget) versions 3.3.5 and earlier **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS attacks. **Recommendations** For Content Blocks (Custom Post Widget) versions 3.3.5 and earlier, update to a version later than 3.3.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Enter Addons – Ultimate Template Builder for Elementor plugin for WordPress versions up to, and including, 2.1.8 **Description** The issue is related to Stored Cross-Site Scripting via the `tag` attribute of the Events Card widget due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.1.8, update to a version higher than 2.1.8 to resolve the issue. As a temporary workaround, consider restricting access to the Events Card widget or disabling the `tag` attribute to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** The Responsive video plugin for WordPress versions up to, and including, 1.0 **Description** The issue is related to Stored Cross-Site Scripting via the plugin's video settings function due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, provided that responsive videos are enabled for posts. **Recommendations** For versions up to, and including, 1.0, update to a version that addresses the insufficient input sanitization and output escaping issue. As a temporary workaround, consider disabling the video settings function until a patch is available. Restrict access to the plugin's video settings to minimize the risk of exploitation, ensuring only trusted users with appropriate permissions can access these settings.

**Name of the Vulnerable Software and Affected Versions** The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress versions up to, and including, 2.2.87 **Description** The issue is related to Stored Cross-Site Scripting via the plugin's Accordion block due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. **Recommendations** For versions up to, and including, 2.2.87, update to a version that includes the necessary input sanitization and output escaping fixes to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the Accordion block for users with contributor-level access and above until a patch is available.