Vulnerability · Published May 15, 2025 · Assigned by WPScan
CVE-2024-3901Genesis Blocks <= 3.1.3 - Contributor+ Stored XSS
Medium 6.8
In plain English
A medium-severity security flaw in Genesis Blocks from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.6%top 52.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts (like those with the contributor role) to conduct Stored XSS attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Genesis Blocks | 0 – through 3.1.3 |
References
- https://wpscan.com/vulnerability/9502e1ac-346e-4431-90a6-61143d2df37b/ exploit, vdb-entry, technical-description