CVE-2024-12878

CVE-2024-12878 is a reflected cross-site scripting (XSS) vulnerability in the Custom Block Builder WordPress plugin versions prior to 3.8.3. The flaw arises because the plugin fails to properly sanitize and escape a parameter before outputting it back in the page, allowing malicious scripts to be injected and executed in a victim's browser. This issue is classified under CWE-79 (Cross-Site Scripting) with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and potential for scope change.

Attackers can exploit this vulnerability remotely without authentication by tricking a targeted user, such as a high-privilege administrator, into interacting with a maliciously crafted link or page. Successful exploitation executes arbitrary JavaScript in the victim's browser context, potentially enabling theft of session cookies, keystroke logging, or other actions that compromise the admin account, leading to low-level impacts on confidentiality, integrity, and availability.

The WPScan advisory at https://wpscan.com/vulnerability/827444d1-87cb-4057-827a-d802eac82cf8/ details the issue, with mitigation achieved by updating the Custom Block Builder plugin to version 3.8.3 or later, which addresses the sanitization deficiency.