CVE-2024-12581

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.53 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://research.cleantalk.org/cve-2024-10637/Exploit, Mitigation, Third Party Advisory
• https://wpscan.com/vulnerability/df688dcc-9617-4f58-a310-891bfaea3695/Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/406f3eaf-44a7-4e32-a620-8799eb74742a?source=cveThird Party Advisory

Published

Dec 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12576Software installed and run as a non-privileged user may cond…5.5
• CVE-2024-12577Kernel software installed and running inside a Guest VM may …7.3
• CVE-2024-12578The Tickera – WordPress Event Ticketing plugin for WordPress…5.3
• CVE-2024-12579The Minify HTML plugin for WordPress is vulnerable to Regula…5.3
• CVE-2024-1258A vulnerability was found in Juanpao JPShop up to 1.5.02. It…5.9
• CVE-2024-12580A vulnerability in danny-avila/librechat prior to version 0.…5.3
• CVE-2024-12582A flaw was found in the skupper console, a read-only interf…7.1
• CVE-2024-12583The Dynamics 365 Integration plugin for WordPress is vulnera…9.9
• CVE-2024-12584The 140+ Widgets | Xpro Addons For Elementor – FREE plugin f…6.5
• CVE-2024-12585The Property Hive WordPress plugin before 2.1.1 does not san…6.1
• CVE-2024-12586The Chalet-Montagne.com Tools WordPress plugin through 2.7.8…6.1
• CVE-2024-12587The Contact Form Master WordPress plugin through 1.0.7 does…6.1