CVE-2024-8760

The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration such as admin nonces with limited impact. These nonces could be used to perform CSRF attacks within a limited time window. The presence of other plugins may make additional nonces available, which may pose a risk in plugins that don't perform capability checks to protect AJAX actions or other actions reachable by lower-privileged users.

• CWE-94

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3158674%40stackable-ultimate-gutenberg-blocks%2Ftrunk&old=3156448%40stackable-ultimate-gutenberg-blocks%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1fd0b13c-7447-45da-9608-80b7629d9bbf?source=cve

Published

Oct 12, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8754An issue has been discovered in GitLab EE/CE affecting all v…8.1
• CVE-2024-8755Improper Input Validation vulnerability of Authenticated Use…9.8
• CVE-2024-8756The Quform - WordPress Form Builder plugin for WordPress is …5.3
• CVE-2024-8757The WP Post Author – Boost Your Blog's Engagement with …7.2
• CVE-2024-8758The Quiz and Survey Master (QSM) WordPress plugin before 9.…4.8
• CVE-2024-8759The Nested Pages WordPress plugin before 3.2.9 does not sani…4.8
• CVE-2024-8761The Share This Image plugin for WordPress is vulnerable to O…6.1
• CVE-2024-8762A vulnerability was found in code-projects Crud Operation Sy…9.8
• CVE-2024-8763A Regular Expression Denial of Service (ReDoS) vulnerability…7.5
• CVE-2024-8764A vulnerability in lunary-ai/lunary, as of commit be54057, a…7.5
• CVE-2024-8765In lunary-ai/lunary, the privilege check mechanism is flawed…7.3
• CVE-2024-8766Local privilege escalation due to DLL hijacking vulnerabilit…6.7