CVE-2024-8760: CWE-94 Improper Control of Generation of Code ('Code Injection') in bfintal Stackable – Page Builder Gutenberg Blocks
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration such as admin nonces with limited impact. These nonces could be used to perform CSRF attacks within a limited time window. The presence of other plugins may make additional nonces available, which may pose a risk in plugins that don't perform capability checks to protect AJAX actions or other actions reachable by lower-privileged users.
AI Analysis
Technical Summary
CVE-2024-8760 describes a CSS Injection vulnerability in the Stackable – Page Builder Gutenberg Blocks plugin for WordPress, affecting all versions up to 3.13.6. The flaw allows unauthenticated attackers to embed malicious CSS in comments, potentially exfiltrating sensitive data like admin nonces. These nonces could be exploited to conduct CSRF attacks during their validity period. The presence of other plugins that do not enforce capability checks on AJAX or other actions may increase the attack surface. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code).
Potential Impact
The vulnerability allows limited data exfiltration, specifically admin nonces, which can be leveraged for CSRF attacks within a limited time window. The impact is limited to confidentiality (partial data leakage) with no direct integrity or availability impact. The risk may be elevated in environments with additional vulnerable plugins that expose nonces without proper access controls.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, consider restricting comment input or disabling the affected plugin if feasible. Monitor vendor channels for updates and apply official fixes once released.
CVE-2024-8760: CWE-94 Improper Control of Generation of Code ('Code Injection') in bfintal Stackable – Page Builder Gutenberg Blocks
Description
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting in a possibility of data exfiltration such as admin nonces with limited impact. These nonces could be used to perform CSRF attacks within a limited time window. The presence of other plugins may make additional nonces available, which may pose a risk in plugins that don't perform capability checks to protect AJAX actions or other actions reachable by lower-privileged users.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-8760 describes a CSS Injection vulnerability in the Stackable – Page Builder Gutenberg Blocks plugin for WordPress, affecting all versions up to 3.13.6. The flaw allows unauthenticated attackers to embed malicious CSS in comments, potentially exfiltrating sensitive data like admin nonces. These nonces could be exploited to conduct CSRF attacks during their validity period. The presence of other plugins that do not enforce capability checks on AJAX or other actions may increase the attack surface. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code).
Potential Impact
The vulnerability allows limited data exfiltration, specifically admin nonces, which can be leveraged for CSRF attacks within a limited time window. The impact is limited to confidentiality (partial data leakage) with no direct integrity or availability impact. The risk may be elevated in environments with additional vulnerable plugins that expose nonces without proper access controls.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, consider restricting comment input or disabling the affected plugin if feasible. Monitor vendor channels for updates and apply official fixes once released.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-09-12T19:06:44.835Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6b30b7ef31ef0b54f257
Added to database: 2/25/2026, 9:35:44 PM
Last enriched: 4/9/2026, 8:29:55 PM
Last updated: 4/12/2026, 3:01:58 PM
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.