WordPress aBlocks permission and access control issue vulnerability

WordPress aBlocks versions 2.17.0 and earlier contain a permission and access control vulnerability. This vulnerability arises because the permission callback for the /ablocks/v1/form-builder/registration REST endpoint is set to returntrue. The register handler fails to verify whether the formTyp...

CVE-2026-57386

The CVE-2026-57386 entry affects the WordPress aBlocks plugin by Kodezen LLC, with versions prior to 2.9.1 vulnerable to an Incorrect Privilege Assignment that enables privilege escalation. The NVD PatchStack entries corroborate that the issue lies in a blocks ablocks and is exploitable with high...

CVE-2025-47616 WordPress aBlocks <= 1.9.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Tushar Imran aBlocks allows Stored XSS.This issue affects aBlocks: from n/a through 1.9.2...