/Vulnerability Library

Lazy Blocks <= 3.8.2 - Cross-Site Scripting

CVE-2024-12878
Verified

Description

Custom Block Builder WordPress plugin < 3.8.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to load malicious page.

Severity

Medium

Published Date

February 11, 2026

Template Author

shivam kamboj

CVE-2024-12878.yaml
5.0Severity

CVSS Metrics

References

https://wpscan.com/vulnerability/827444d1-87cb-4057-827a-d802eac82cf8/https://nvd.nist.gov/vuln/detail/CVE-2024-12878

Remediation Steps

Update to version 3.8.3 or later.