Authenticated (Contributor+) Stored Cross-Site Scripting via CF7 and Gravity Forms Styler Form ID

The Contact Form 7 and Gravity Forms styler blocks used the formId block attribute directly, concatenating it into a shortcode string that is then echoed. A user able to insert or edit a block (Contributor and above) could set formId to a value that breaks out of the shortcode, causing arbitrary HTML or script to be rendered for anyone viewing the page. The Gravity Forms block passed formTabIndex through unchecked in the same way. All versions up to and including 2.20.2 are affected; 2.20.3 casts both values with intval() and defaults formId to 0 when absent.

This vulnerability affects the following application versions:

• Spectra – WordPress Gutenberg Blocks 1.5.1
• Spectra – WordPress Gutenberg Blocks 1.10.0
• Spectra – WordPress Gutenberg Blocks 1.11.0
• Spectra – WordPress Gutenberg Blocks 1.11.1
• Spectra – WordPress Gutenberg Blocks 1.12.0
• Spectra – WordPress Gutenberg Blocks 1.12.1
• Spectra – WordPress Gutenberg Blocks 1.12.2
• Spectra – WordPress Gutenberg Blocks 1.12.3
• Spectra – WordPress Gutenberg Blocks 1.12.4
• Spectra – WordPress Gutenberg Blocks 1.12.5
• Spectra – WordPress Gutenberg Blocks 1.13.0
• Spectra – WordPress Gutenberg Blocks 1.13.1
• Spectra – WordPress Gutenberg Blocks 1.13.2
• Spectra – WordPress Gutenberg Blocks 1.13.3
• Spectra – WordPress Gutenberg Blocks 1.13.4
• Spectra – WordPress Gutenberg Blocks 1.13.5
• Spectra – WordPress Gutenberg Blocks 1.13.6
• Spectra – WordPress Gutenberg Blocks 1.14.0
• Spectra – WordPress Gutenberg Blocks 1.14.1
• Spectra – WordPress Gutenberg Blocks 1.14.2
• Spectra – WordPress Gutenberg Blocks 1.14.3
• Spectra – WordPress Gutenberg Blocks 1.14.4
• Spectra – WordPress Gutenberg Blocks 1.14.5
• Spectra – WordPress Gutenberg Blocks 1.14.6
• Spectra – WordPress Gutenberg Blocks 1.14.7
• Spectra – WordPress Gutenberg Blocks 1.14.8
• Spectra – WordPress Gutenberg Blocks 1.14.9
• Spectra – WordPress Gutenberg Blocks 1.14.10
• Spectra – WordPress Gutenberg Blocks 1.14.11
• Spectra – WordPress Gutenberg Blocks 1.15.0
• Spectra – WordPress Gutenberg Blocks 1.15.1
• Spectra – WordPress Gutenberg Blocks 1.15.2
• Spectra – WordPress Gutenberg Blocks 1.16.0
• Spectra – WordPress Gutenberg Blocks 1.16.1
• Spectra – WordPress Gutenberg Blocks 1.17.0
• Spectra – WordPress Gutenberg Blocks 1.18.0
• Spectra – WordPress Gutenberg Blocks 1.18.1
• Spectra – WordPress Gutenberg Blocks 1.18.2
• Spectra – WordPress Gutenberg Blocks 1.19.0
• Spectra – WordPress Gutenberg Blocks 1.20.0
• Spectra – WordPress Gutenberg Blocks 1.20.1
• Spectra – WordPress Gutenberg Blocks 1.21.0
• Spectra – WordPress Gutenberg Blocks 1.21.1
• Spectra – WordPress Gutenberg Blocks 1.22.0
• Spectra – WordPress Gutenberg Blocks 1.22.1
• Spectra – WordPress Gutenberg Blocks 1.22.2
• Spectra – WordPress Gutenberg Blocks 1.22.3
• Spectra – WordPress Gutenberg Blocks 1.22.4
• Spectra – WordPress Gutenberg Blocks 1.22.5
• Spectra – WordPress Gutenberg Blocks 1.23.0
• Spectra – WordPress Gutenberg Blocks 1.23.1
• Spectra – WordPress Gutenberg Blocks 1.23.2
• Spectra – WordPress Gutenberg Blocks 1.23.3
• Spectra – WordPress Gutenberg Blocks 1.23.4
• Spectra – WordPress Gutenberg Blocks 1.23.5
• Spectra – WordPress Gutenberg Blocks 1.24.0
• Spectra – WordPress Gutenberg Blocks 1.24.1
• Spectra – WordPress Gutenberg Blocks 1.24.2
• Spectra – WordPress Gutenberg Blocks 1.25.0
• Spectra – WordPress Gutenberg Blocks 1.25.1
• Spectra – WordPress Gutenberg Blocks 1.25.2
• Spectra – WordPress Gutenberg Blocks 1.25.3
• Spectra – WordPress Gutenberg Blocks 1.25.4
• Spectra – WordPress Gutenberg Blocks 1.25.5
• Spectra – WordPress Gutenberg Blocks 1.25.6
• Spectra – WordPress Gutenberg Blocks 2.0.0
• Spectra – WordPress Gutenberg Blocks 2.0.1
• Spectra – WordPress Gutenberg Blocks 2.0.2
• Spectra – WordPress Gutenberg Blocks 2.0.3
• Spectra – WordPress Gutenberg Blocks 2.0.4
• Spectra – WordPress Gutenberg Blocks 2.0.5
• Spectra – WordPress Gutenberg Blocks 2.0.6
• Spectra – WordPress Gutenberg Blocks 2.0.7
• Spectra – WordPress Gutenberg Blocks 2.0.8
• Spectra – WordPress Gutenberg Blocks 2.0.9
• Spectra – WordPress Gutenberg Blocks 2.0.10
• Spectra – WordPress Gutenberg Blocks 2.0.11
• Spectra – WordPress Gutenberg Blocks 2.0.12
• Spectra – WordPress Gutenberg Blocks 2.0.13
• Spectra – WordPress Gutenberg Blocks 2.0.14
• Spectra – WordPress Gutenberg Blocks 2.0.15
• Spectra – WordPress Gutenberg Blocks 2.0.16
• Spectra – WordPress Gutenberg Blocks 2.1.0
• Spectra – WordPress Gutenberg Blocks 2.1.1
• Spectra – WordPress Gutenberg Blocks 2.2.0
• Spectra – WordPress Gutenberg Blocks 2.3.0
• Spectra – WordPress Gutenberg Blocks 2.3.1
• Spectra – WordPress Gutenberg Blocks 2.3.2
• Spectra – WordPress Gutenberg Blocks 2.3.3
• Spectra – WordPress Gutenberg Blocks 2.3.4
• Spectra – WordPress Gutenberg Blocks 2.3.5
• Spectra – WordPress Gutenberg Blocks 2.4.0
• Spectra – WordPress Gutenberg Blocks 2.4.1
• Spectra – WordPress Gutenberg Blocks 2.4.2
• Spectra – WordPress Gutenberg Blocks 2.5.0
• Spectra – WordPress Gutenberg Blocks 2.5.1
• Spectra – WordPress Gutenberg Blocks 2.6.0
• Spectra – WordPress Gutenberg Blocks 2.6.1
• Spectra – WordPress Gutenberg Blocks 2.6.2
• Spectra – WordPress Gutenberg Blocks 2.6.3
• Spectra – WordPress Gutenberg Blocks 2.6.4
• Spectra – WordPress Gutenberg Blocks 2.6.5
• Spectra – WordPress Gutenberg Blocks 2.6.6
• Spectra – WordPress Gutenberg Blocks 2.6.7
• Spectra – WordPress Gutenberg Blocks 2.6.8
• Spectra – WordPress Gutenberg Blocks 2.6.9
• Spectra – WordPress Gutenberg Blocks 2.7.0
• Spectra – WordPress Gutenberg Blocks 2.7.1
• Spectra – WordPress Gutenberg Blocks 2.7.2
• Spectra – WordPress Gutenberg Blocks 2.7.3
• Spectra – WordPress Gutenberg Blocks 2.7.4
• Spectra – WordPress Gutenberg Blocks 2.7.5
• Spectra – WordPress Gutenberg Blocks 2.7.6
• Spectra – WordPress Gutenberg Blocks 2.7.7
• Spectra – WordPress Gutenberg Blocks 2.7.8
• Spectra – WordPress Gutenberg Blocks 2.7.9
• Spectra – WordPress Gutenberg Blocks 2.7.10
• Spectra – WordPress Gutenberg Blocks 2.7.11
• Spectra – WordPress Gutenberg Blocks 2.8.0
• Spectra – WordPress Gutenberg Blocks 2.9.0
• Spectra – WordPress Gutenberg Blocks 2.9.1
• Spectra – WordPress Gutenberg Blocks 2.10.0
• Spectra – WordPress Gutenberg Blocks 2.10.1
• Spectra – WordPress Gutenberg Blocks 2.10.2
• Spectra – WordPress Gutenberg Blocks 2.10.3
• Spectra – WordPress Gutenberg Blocks 2.10.4
• Spectra – WordPress Gutenberg Blocks 2.10.5
• Spectra – WordPress Gutenberg Blocks 2.11.0
• Spectra – WordPress Gutenberg Blocks 2.11.1
• Spectra – WordPress Gutenberg Blocks 2.11.2
• Spectra – WordPress Gutenberg Blocks 2.11.3
• Spectra – WordPress Gutenberg Blocks 2.11.4
• Spectra – WordPress Gutenberg Blocks 2.12.0
• Spectra – WordPress Gutenberg Blocks 2.12.1
• Spectra – WordPress Gutenberg Blocks 2.12.2
• Spectra – WordPress Gutenberg Blocks 2.12.3
• Spectra – WordPress Gutenberg Blocks 2.12.4
• Spectra – WordPress Gutenberg Blocks 2.12.5
• Spectra – WordPress Gutenberg Blocks 2.12.6
• Spectra – WordPress Gutenberg Blocks 2.12.7
• Spectra – WordPress Gutenberg Blocks 2.12.8
• Spectra – WordPress Gutenberg Blocks 2.12.9
• Spectra – WordPress Gutenberg Blocks 2.13.0
• Spectra – WordPress Gutenberg Blocks 2.13.1
• Spectra – WordPress Gutenberg Blocks 2.13.2
• Spectra – WordPress Gutenberg Blocks 2.13.3
• Spectra – WordPress Gutenberg Blocks 2.13.4
• Spectra – WordPress Gutenberg Blocks 2.13.5
• Spectra – WordPress Gutenberg Blocks 2.13.6
• Spectra – WordPress Gutenberg Blocks 2.13.7
• Spectra – WordPress Gutenberg Blocks 2.13.8
• Spectra – WordPress Gutenberg Blocks 2.13.9
• Spectra – WordPress Gutenberg Blocks 2.14.0
• Spectra – WordPress Gutenberg Blocks 2.14.1
• Spectra – WordPress Gutenberg Blocks 2.15.0
• Spectra – WordPress Gutenberg Blocks 2.15.1
• Spectra – WordPress Gutenberg Blocks 2.15.2
• Spectra – WordPress Gutenberg Blocks 2.15.3
• Spectra – WordPress Gutenberg Blocks 2.16.0
• Spectra – WordPress Gutenberg Blocks 2.16.1
• Spectra – WordPress Gutenberg Blocks 2.16.2
• Spectra – WordPress Gutenberg Blocks 2.16.3
• Spectra – WordPress Gutenberg Blocks 2.16.4
• Spectra – WordPress Gutenberg Blocks 2.16.5
• Spectra – WordPress Gutenberg Blocks 2.17.0
• Spectra – WordPress Gutenberg Blocks 2.18.0
• Spectra – WordPress Gutenberg Blocks 2.18.1
• Spectra – WordPress Gutenberg Blocks 2.18.2
• Spectra – WordPress Gutenberg Blocks 2.18.3
• Spectra – WordPress Gutenberg Blocks 2.19.0
• Spectra – WordPress Gutenberg Blocks 2.19.1
• Spectra – WordPress Gutenberg Blocks 2.19.2
• Spectra – WordPress Gutenberg Blocks 2.19.3
• Spectra – WordPress Gutenberg Blocks 2.19.4
• Spectra – WordPress Gutenberg Blocks 2.19.5
• Spectra – WordPress Gutenberg Blocks 2.19.6
• Spectra – WordPress Gutenberg Blocks 2.19.7
• Spectra – WordPress Gutenberg Blocks 2.19.8
• Spectra – WordPress Gutenberg Blocks 2.19.9
• Spectra – WordPress Gutenberg Blocks 2.19.10
• Spectra – WordPress Gutenberg Blocks 2.19.11
• Spectra – WordPress Gutenberg Blocks 2.19.11-beta.1
• Spectra – WordPress Gutenberg Blocks 2.19.12
• Spectra – WordPress Gutenberg Blocks 2.19.13
• Spectra – WordPress Gutenberg Blocks 2.19.14
• Spectra – WordPress Gutenberg Blocks 2.19.15
• Spectra – WordPress Gutenberg Blocks 2.19.16
• Spectra – WordPress Gutenberg Blocks 2.19.17
• Spectra – WordPress Gutenberg Blocks 2.19.18
• Spectra – WordPress Gutenberg Blocks 2.19.19
• Spectra – WordPress Gutenberg Blocks 2.19.20
• Spectra – WordPress Gutenberg Blocks 2.19.21
• Spectra – WordPress Gutenberg Blocks 2.19.22
• Spectra – WordPress Gutenberg Blocks 2.19.23
• Spectra – WordPress Gutenberg Blocks 2.19.24
• Spectra – WordPress Gutenberg Blocks 2.19.25
• Spectra – WordPress Gutenberg Blocks 2.19.26
• Spectra – WordPress Gutenberg Blocks 2.19.27
• Spectra – WordPress Gutenberg Blocks 2.19.28
• Spectra – WordPress Gutenberg Blocks 2.19.29
• Spectra – WordPress Gutenberg Blocks 2.20.0
• Spectra – WordPress Gutenberg Blocks 2.20.1
• Spectra – WordPress Gutenberg Blocks 2.20.2
• Spectra – WordPress Gutenberg Blocks 3.0.0-beta.1
• Spectra – WordPress Gutenberg Blocks 3.0.0-beta.2