CVE-2025-4682 Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML attributes in Slider and Post Carousel widgets in all versions up to, and including, 5.4.0 due to insufficient input sanitization and output...

CVE-2025-4682

CVE-2025-4682 covers the WordPress plugin Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates (vulnerability in the Slider and Post Carousel widgets). The root cause is insufficient input sanitization and output escaping, enabling stored XSS via HTML attributes. Affected: all v...

WordPress Essential Blocks plugin <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Slider and Post Carousel Widgets vulnerability discovered by Webbernaut in WordPress Plugin Essential Blocks for Gutenberg versions = 5.4.0...

WordPress plugin Essential Blocks 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

The vulnerability of the btrfs_get_blocks_direct_write() function in the file system of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the btrfsgetblocksdirectwrite function in the file system of the Linux operating system is related to resource management errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

Malicious code in blocks-nextjs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ae607db145f1ae39e7375c25cd19509f7f82eb76be82e74ff5cc37650ef27ba Any computer that has this package installed or running should be considered...

MAL-2025-4425 Malicious code in blocks-nextjs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ae607db145f1ae39e7375c25cd19509f7f82eb76be82e74ff5cc37650ef27ba Any computer that has this package installed or running should be considered...

CVE-2025-24753

Missing Authorization vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through = 3.3.1...

CVE-2025-24712

Cross-Site Request Forgery CSRF vulnerability in RadiusTheme Radius Blocks radius-blocks allows Cross Site Request Forgery.This issue affects Radius Blocks: from n/a through = 2.1.2...

CVE-2025-22529

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wordpresteem WE Blocks we-blocks allows Stored XSS.This issue affects WE Blocks: from n/a through = 1.3.5...

CVE-2025-24696

Cross-Site Request Forgery CSRF vulnerability in Shafaet Alam Attire Blocks attire-blocks allows Cross Site Request Forgery.This issue affects Attire Blocks: from n/a through = 1.9.6...

CVE-2025-22810

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Phi Phan Content Blocks Builder content-blocks-builder allows Stored XSS.This issue affects Content Blocks Builder: from n/a through = 2.7.6...

CVE-2024-43293

Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through 3.3.1...

CVE-2024-49270

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hashthemes Smart Blocks smart-blocks allows Stored XSS.This issue affects Smart Blocks: from n/a through = 2.0...

CVE-2024-52357

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in lqd LIQUID BLOCKS liquid-blocks allows Stored XSS.This issue affects LIQUID BLOCKS: from n/a through = 1.2.0...

CVE-2024-9372

The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, ...

CVE-2024-44059

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through = 5.3.1...

CVE-2024-43946

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in SKT Themes SKT Blocks – Gutenberg based Page Builder allows Stored XSS.This issue affects SKT Blocks – Gutenberg based Page Builder: from n/a through 1.5...

CVE-2024-43284

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WP Travel WP Travel Gutenberg Blocks allows Stored XSS.This issue affects WP Travel Gutenberg Blocks: from n/a through 3.5.1...

CVE-2024-43349

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in allbootstrapblocks All Bootstrap Blocks all-bootstrap-blocks.This issue affects All Bootstrap Blocks: from n/a through = 1.3.19...