Read the docs
TI-2024-08126 Aliases CVE-2024-8760GHSA-v7vw-qwr3-vgr4

Stackable – Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection

Priority LOW 24CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration such as admin nonces with limited impact. These nonces could be used to perform CSRF attacks within a limited time window. The presence of other plugins may make additional nonces available, which may pose a risk in plugins that don't perform capability checks to protect AJAX actions or other actions reachable by lower-privileged users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bfintalStackable – Page Builder Gutenberg Blocksup to 3.13.6—No fix listedCNA
  • Stackable – Page Builder Gutenberg Blocks Vendorbfintal Affected up to 3.13.6 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8760
  2. 2026-10-03 Alias added: GHSA-v7vw-qwr3-vgr4

References

Other 2

  • TI-2024-05843 Stackable – Page Builder Gutenberg Blocks <= 3.13.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.4
  • TI-2024-01897 Cross-site scripting in bfintal Stackable – Page Builder Gutenberg Blocks CVSS 3.1MEDIUM 6.4
  • TI-2026-86196 Stored cross-site scripting in Stackable WordPress plugin CVSS 3.1MEDIUM 6.4
  • TI-2025-11651 Cross-site scripting in bfintal Interactions – Create Interactive Experiences in the… CVSS 3.1MEDIUM 6.4
  • TI-2022-04562 Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 3.1MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences