cve-2021-38314

CVE-2021-38314 Python Exploit Detail The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministic and...

CVE-2026-7465-Lab

CVE-2026-7465 - Spectra Gutenberg Blocks Local Lab Local Docker lab for analyzing and reproducing CVE-2026-7465 in the WordPress plugin Spectra Gutenberg Blocks ultimate-addons-for-gutenberg. This lab compares: vuln: Spectra 2.19.25 patched: Spectra 2.19.26 The proof is intentionally least-harm. ...

EUVD-2026-109265

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the /ablocks/v1/form-builder/registration REST endpoint. The vulnerability exists...

-CVE-2026-7465

-CVE-2026-7465 CVE-2026-7465 Spectra Gutenberg Blocks Authenticated RCE Exploit...

CVE-2026-115807

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...

EUVD-2026-109212

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...

CVE-2026-115807

The User Profile Builder WordPress plugin is vulnerable to Limited Privilege Escalation in versions up to and including 4.0.3 . The vulnerability exists because the Gutenberg Register block passes an attacker-controlled Assigned Role attribute directly into the [wppb-register] shortcode without s...

CVE-2026-115807 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role...

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

Post Grid <= 2.2.50 - Information Exposure via REST API

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50. id: CVE-2023-40211 info: name: Post Grid = 2.2.50 - Information Exposure via REST API...

WordPress Otter Blocks plugin 3.1.1-3.2.7 - Unauthenticated Non-Public Content Disclosure vulnerability

Unauthenticated Non-Public Content Disclosure vulnerability discovered by whp-wessel in WordPress Plugin Otter - Gutenberg Block versions 3.1.1-3.2.7...

CVE-2026-96840

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via displayname User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

EUVD-2026-96224

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via displayname User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-96840

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.1.0 . The root cause is insufficient input sanitization and output escaping in the display_name User Field. Specifically, while WordPress core encod...

CVE-2026-96840 Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via displayname User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2026-91862

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-91862

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.0.1 . The root cause is insufficient input sanitization and output escaping associated with the 'data-image-points' parameter. This flaw allows authenticated...

CVE-2026-91862 Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-96101

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-96840: Improper Neutralization of Input During Web Page Generation

The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via displayname User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...