CVE-2024-12878

HIGHNuclei

Custom Block Builder – Lazy Blocks < 3.8.3 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-12878 has a selected CVSS score of 7.1 (high); EIP currently links 1 Nuclei template.

Description

The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 26, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Custom Block Builder

Default status: unaffected

CVE ListBefore 3.8.3affected

Nuclei templates

1
ProjectDiscoveryMEDIUMLazy Blocks <= 3.8.2 - Cross-Site Scripting

Custom Block Builder WordPress plugin < 3.8.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to load malicious page.

Impact

Attackers can execute malicious scripts in high privilege users' browsers, potentially leading to session hijacking or account compromise.

Remediation

Update to version 3.8.3 or later.

AuthorsShivam Kamboj
Template tagscvecve2024wordpresswpwp-pluginlazy-blocksxssreflectedauthenticated
https://wpscan.com/vulnerability/827444d1-87cb-4057-827a-d802eac82cf8/ https://nvd.nist.gov/vuln/detail/CVE-2024-12878

Source: ProjectDiscovery

References

2