CVE-2024-12878
Published: 26 February 2025
Summary
CVE-2024-12878 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Thedevoice Lazy Blocks. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-12878 is a reflected cross-site scripting (XSS) vulnerability in the Custom Block Builder WordPress plugin versions prior to 3.8.3. The flaw arises because the plugin fails to properly sanitize and escape a parameter before outputting it back in the page, allowing malicious scripts to be injected and executed in a victim's browser. This issue is classified under CWE-79 (Cross-Site Scripting) with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and potential for scope change.
Attackers can exploit this vulnerability remotely without authentication by tricking a targeted user, such as a high-privilege administrator, into interacting with a maliciously crafted link or page. Successful exploitation executes arbitrary JavaScript in the victim's browser context, potentially enabling theft of session cookies, keystroke logging, or other actions that compromise the admin account, leading to low-level impacts on confidentiality, integrity, and availability.
The WPScan advisory at https://wpscan.com/vulnerability/827444d1-87cb-4057-827a-d802eac82cf8/ details the issue, with mitigation achieved by updating the Custom Block Builder plugin to version 3.8.3 or later, which addresses the sanitization deficiency.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5312
Vulnerability details
The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of web app (T1190) via malicious links (T1566.002) to steal session cookies (T1539) or perform input capture in admin context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates reflected XSS by requiring filtering of outputs prior to display, addressing the failure to escape the vulnerable parameter before page output.
Directly addresses the sanitization deficiency by enforcing validation of information inputs like the untrusted parameter to prevent malicious script injection.
Ensures timely flaw remediation through plugin updates to version 3.8.3 or later, eliminating the specific XSS vulnerability.