CVE-2024-50452: Nexter Blocks Stored XSS Vulnerability

CVE-2024-50452 Overview

CVE-2024-50452 is a stored Cross-Site Scripting (XSS) vulnerability in the POSIMYTH Nexter Blocks plugin (the-plus-addons-for-block-editor) for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Authenticated attackers with low privileges can inject malicious scripts that persist within the application and execute in the browsers of other users who view the affected content.

The vulnerability affects Nexter Blocks versions up to and including 3.3.3. Successful exploitation requires user interaction and can result in session theft, content manipulation, or redirection to attacker-controlled resources.

Critical Impact
Authenticated contributors can store malicious JavaScript that executes against site administrators and visitors, enabling account takeover and further compromise of the WordPress instance.

Affected Products

POSIMYTH Nexter Blocks (the-plus-addons-for-block-editor) WordPress plugin
All versions from n/a through 3.3.3
WordPress sites where authenticated contributors or higher roles can author content using the plugin

Discovery Timeline

2026-02-20 - CVE-2024-50452 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-50452

Vulnerability Analysis

The vulnerability is a stored XSS issue in the Nexter Blocks WordPress plugin. The plugin fails to sanitize and escape user-supplied input before storing it in the database and rendering it within the web page output. An authenticated user with content authoring privileges can submit payloads containing JavaScript through plugin-controlled block parameters.

When another user — including an administrator — loads a page containing the malicious block, the injected script executes in their browser session. Because the payload is persisted server-side, the attack triggers automatically on each view, without requiring the victim to click a crafted link.

The CWE-79 classification confirms the root issue: improper neutralization of input during web page generation. The scope change in the CVSS vector reflects that script execution crosses trust boundaries between the low-privileged author and higher-privileged victims.

Root Cause

The plugin accepts block configuration data — such as text, URLs, or HTML attributes — and writes that data into the rendered DOM without applying WordPress sanitization helpers such as wp_kses_post(), esc_attr(), or esc_html(). The absence of contextual output encoding allows raw <script> tags or event handler attributes to pass through to the browser.

Attack Vector

Exploitation requires network access, low privileges, and user interaction. The attacker authenticates to a WordPress site running a vulnerable version of Nexter Blocks. The attacker then creates or edits a post or page, embedding a Nexter block whose parameters contain a JavaScript payload. When an editor or administrator previews or publishes the content, the payload executes under the victim's session and origin. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2024-50452

Indicators of Compromise

WordPress posts, pages, or wp_postmeta rows containing <script> tags, javascript: URIs, or on* event handlers within Nexter block attributes
Outbound browser requests from /wp-admin/ sessions to unfamiliar third-party domains
New or unexpected administrator accounts created shortly after a contributor authored Nexter block content

Detection Strategies

Inventory WordPress installations and identify sites running the-plus-addons-for-block-editor at version 3.3.3 or earlier
Scan post content and post metadata for HTML attributes and block JSON containing inline JavaScript patterns
Review web server access logs for suspicious POST requests to /wp-admin/post.php or the block editor REST endpoints from low-privileged accounts

Monitoring Recommendations

Enable WordPress audit logging for content edits, user role changes, and plugin installations
Deploy a Content Security Policy (CSP) that restricts inline script execution and report violations to a central log
Forward WordPress and web server telemetry to a centralized SIEM to correlate authoring activity with anomalous browser behavior

How to Mitigate CVE-2024-50452

Immediate Actions Required

Update the Nexter Blocks plugin to a version higher than 3.3.3 as soon as a fixed release is available from POSIMYTH
Audit existing posts and pages authored with Nexter Blocks for stored JavaScript payloads and remove malicious content
Restrict contributor and author role assignments to trusted users only until the plugin is patched

Patch Information

Review the Patchstack Vulnerability Report for the latest fix status. Apply the vendor patch through the WordPress plugin updater once published. Verify the installed version reports higher than 3.3.3 after upgrade.

Workarounds

Disable or uninstall the Nexter Blocks plugin until a patched version is installed
Enforce a strict Content Security Policy that blocks inline scripts and unsafe event handlers across the WordPress front end and admin
Place the WordPress site behind a web application firewall with rules that block XSS payloads in block editor requests

bash

# Configuration example: enforce CSP header in nginx for WordPress
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;