WordPress Gutenberg Blocks by WordPress Download Manager Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Blocks by WordPress Download Manager Type Plugin Vulnerable versions = 2.1.8 Fixed in 2.1.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22713 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b3d1d81613d1...

WordPress Qubely – Advanced Gutenberg Blocks Plugin <= 1.8.4 is vulnerable to Cross Site Scripting (XSS)

Software Qubely – Advanced Gutenberg Blocks Type Plugin Vulnerable versions = 1.8.4 Fixed in 1.8.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0376 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1329c46c6231 Credits...

Spectra < 1.15.0 - Contributor+ Stored Cross-Side Scripting

The plugin does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks. PoC Note: The exploit requires the Contact Form 7 plugin. Exploit Additional CSS classes for “Contact Form 7 Styler” Gutenberg...

WordPress Blocks Bakery – Gutenberg Blocks plugin <= 1.0.12 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Blocks Bakery – Gutenberg Blocks plugin versions = 1.0.12. Solution No patched version available...

WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin < 2.4.13 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin versions 2.4.13. Solution Update the WordPress Ultimate Blocks – Gutenberg Blocks Plugin plugin to the latest available version at least 2.4.13...

WordPress Page Builder Gutenberg Blocks – Kioken Blocks plugin <= 1.3.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Page Builder Gutenberg Blocks – Kioken Blocks plugin versions = 1.3.9. Solution No patched version available...

WordPress Stackable – Page Builder Gutenberg Blocks plugin < 3.1.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Stackable – Page Builder Gutenberg Blocks plugin versions 3.1.5. Solution Update the WordPress Stackable – Page Builder Gutenberg Blocks plugin to the latest available version at least 3.1.5...

WordPress Stackable – Page Builder Gutenberg Blocks plugin < 3.1.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Stackable – Page Builder Gutenberg Blocks plugin versions 3.1.5. Solution Update the WordPress Stackable – Page Builder Gutenberg Blocks plugin to the latest available version at least 3.1.5...

WordPress Local SEO For Divi & Gutenberg Blocks plugin <= 9.1.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Local SEO For Divi & Gutenberg Blocks plugin versions = 9.1.2. Solution Update the WordPress Local SEO For Divi & Gutenberg Blocks plugin to the latest available version at least 9.1.3...

WordPress Local SEO For Divi & Gutenberg Blocks plugin <= 9.1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Local SEO For Divi & Gutenberg Blocks plugin versions = 9.1.2. Solution Update the WordPress Local SEO For Divi & Gutenberg Blocks plugin to the latest available version at least 9.1.3...

WordPress Convert Classic Editor to Gutenberg Blocks plugin <= 1.0.6 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Convert Classic Editor to Gutenberg Blocks plugin versions = 1.0.6. Solution No patched version available...

WordPress Convert Classic Editor to Gutenberg Blocks plugin <= 1.0.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Convert Classic Editor to Gutenberg Blocks plugin versions = 1.0.6. Solution No patched version available...

WordPress Gutenberg Blocks – ACF Blocks Suite plugin <= 2.6.7 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Gutenberg Blocks – ACF Blocks Suite plugin versions = 2.6.7. Solution Update the WordPress Gutenberg Blocks – ACF Blocks Suite plugin to the latest available version at least 2.6.8...

Critical remote code execution vulnerabilities in WordPress PHP everywhere Plugin

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Three critical remote code execution RCE vulnerabilities in a WordPress plugin PHP everywhere have been discovered. It is a plugin that allows web developers to utilize PHP code in pages, posts, the sidebar, or anywhere on...

CVE-2021-24659

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block...

Cross site scripting

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode...

CVE-2021-24659

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block...

CVE-2021-24660

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode...

CVE-2021-24661 PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Private Content Disclosure

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID...

CVE-2021-24661

The PostX – Gutenberg Blocks for Post Grid WordPress plugin (before 2.4.10) with the Saved Templates Addon enabled permits users with Contributor roles or higher to read password-protected or private post contents they normally cannot access, given a post ID. This is the confirmed issue described...