CVE-2024-11080criticalexploração observadaCWE-94

CVE-2024-11080: falha crítica em pickplugins Post Grid

Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Post Grid

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

50Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Actcvss 9.8epss 0.8%
da publicação à arma
Publicada no NVD5 de set.
VulnCheck4 de set.
The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
pickplugins · Post Grid
CVEs relacionadas — pickplugins Post Grid

No mesmo produto, das mais perigosas para as menos.

CVE-2023-7072HIGHPost Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API EndpointEPSS 0.6%CVE-2021-4450HIGHPost Grid <= 2.1.12 - Contributor+ SQL InjectionEPSS 0.5%CVE-2024-13796MEDIUMPost Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information ExposureEPSS 0.4%CVE-2023-6645MEDIUMPost Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site ScriptingEPSS 0.3%CVE-2024-13798MEDIUMPost Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order CreationEPSS 0.3%CVE-2024-7588MEDIUMGutenberg Blocks, Page Builder – ComboBlocks <= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion BlockEPSS 0.3%