CVE-2026-104762 Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-104762

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.7.12 . The root cause is insufficient input sanitization and output escaping regarding the Block Font Family Attribute . This al...

EUVD-2026-96101

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-91862 Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-91862

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.0.1 . The root cause is insufficient input sanitization and output escaping associated with the 'data-image-points' parameter. This flaw allows authenticated...

CVE-2026-96840: Improper Neutralization of Input During Web Page Generation

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via displayname User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-91862: Improper Neutralization of Input During Web Page Generation

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-104762: Improper Neutralization of Input During Web Page Generation

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Zenith-sec in WordPress Plugin JetFormBuilder versions = 3.6.6...

WordPress Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.12...

WordPress Getwid – Gutenberg Blocks plugin <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by nthng in WordPress Plugin Getwid versions = 3.0.1...

CVE-2026-62036

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31...

CVE-2026-62036

The All Bootstrap Blocks WordPress plugin (versions n/a through 1.3.31 ) is vulnerable to a Sensitive Data Exposure vulnerability (CWE-497). This flaw allows an attacker to retrieve embedded sensitive data from the application. No specific root cause details, remediation steps, or active exploits...

CVE-2026-62036 WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31...

EUVD-2026-95732

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31...

WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Bao - BlueRock in WordPress Plugin All Bootstrap Blocks versions = 1.3.31...

CVE-2026-94632

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58...

CVE-2026-94632 WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58...

CVE-2026-94632

The Stiofan BlockStrap Page Builder - Bootstrap Blocks WordPress plugin (versions n/a through 0.1.58 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. This issue arises from the improper neutralization of input during web page generation. Exploitation of this vulnerability could all...

EUVD-2026-95616

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58...