CVE-2024-10637 in Gutenberg Blocks with AI WP Plugin
Summary
by MITRE • 12/12/2024
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.54 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/07/2025
The vulnerability identified as CVE-2024-10637 affects the Gutenberg Blocks with AI by Kadence WP WordPress plugin version 3.2.53 and earlier. This security flaw represents a stored cross-site scripting vulnerability that specifically targets the plugin's handling of block options within WordPress content management systems. The issue arises from insufficient input validation and output escaping mechanisms within the plugin's codebase, creating a persistent security risk that can be exploited by authenticated users with contributor-level privileges or higher.
The technical implementation of this vulnerability stems from the plugin's failure to properly sanitize user-supplied data before rendering it back to the browser in the context of WordPress posts and pages. When contributors or users with equivalent permissions create or modify content blocks within the Gutenberg editor, the plugin processes block options without adequate validation measures. This insufficient sanitization allows malicious scripts to be embedded within block configurations, which then get executed whenever the affected content is viewed by any user, including administrators. The vulnerability specifically impacts the plugin's handling of block options that are stored in the WordPress database and subsequently rendered in the frontend interface.
The operational impact of this vulnerability extends beyond simple XSS attacks, as it provides attackers with a persistent foothold within WordPress installations. Contributors and users with similar privileges can leverage this weakness to inject malicious JavaScript code that executes in the context of other users' browsers, potentially leading to session hijacking, data theft, or further privilege escalation. The stored nature of this vulnerability means that malicious payloads persist in the database until manually removed, making it particularly dangerous for content management systems where multiple contributors regularly update content. This vulnerability undermines the security model of WordPress installations by allowing lower-privileged users to execute code that could compromise the entire site.
Mitigation strategies for this vulnerability require immediate plugin updates to version 3.2.54 or later, which contain the necessary sanitization patches. Administrators should also implement additional security measures including role-based access controls, regular security audits of user permissions, and monitoring of content changes. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and can be categorized under ATT&CK technique T1548.001 for privilege escalation through malicious content injection. Organizations should conduct comprehensive vulnerability assessments to identify any instances where this plugin might be in use, particularly in environments where contributor-level access is granted to untrusted users. Regular security monitoring and automated patch management systems should be implemented to prevent similar vulnerabilities from being exploited in the future.