WordPress All Bootstrap Blocks plugin 1.3.20-1.3.31 - Contributor+ LFI vulnerability

Contributor+ LFI vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin All Bootstrap Blocks versions 1.3.20-1.3.31...

CVE-2026-88994

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

CVE-2026-88993

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-88994 All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

CVE-2026-88994 All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

CVE-2026-88994

The All Bootstrap Blocks WordPress plugin (versions 1.3.20 through 1.3.31 ) contains a Local File Inclusion (LFI) vulnerability in its Lightspeed subsystem. A block attribute is used to build a filesystem path that is included at render time without validation, allowing users with contributor-lev...

EUVD-2026-82687

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

CVE-2026-88993 All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

WordPress All Bootstrap Blocks plugin <= 1.3.31 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin All Bootstrap Blocks versions = 1.3.31...

EUVD-2026-82679

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-88993 All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-88993

The All Bootstrap Blocks WordPress plugin, affecting versions up to and including 1.3.31 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the plugin fails to properly escape a block attribute before outputting it into an HTML tag-name position . This allows us...

CVE-2026-88993: Improper Neutralization of Input During Web Page Generation

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-88994: Improper Control of Filename for Include/Require Statement in PHP Program

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

EUVD-2023-39083

Malicious code in bioql PyPI...

EUVD-2024-35222

Malicious code in bioql PyPI...

WordPress Plugin All Bootstrap Blocks Access Control Break Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control disruption vulnerability exists in the WordPress plugin All Bootstrap Blocks, which...

CVE-2025-54733

Missing Authorization vulnerability in allbootstrapblocks All Bootstrap Blocks all-bootstrap-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All Bootstrap Blocks: from n/a through = 1.3.28...

CVE-2025-54733: Missing Authorization

Missing Authorization vulnerability in allbootstrapblocks All Bootstrap Blocks all-bootstrap-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All Bootstrap Blocks: from n/a through = 1.3.28...

WordPress plugin All Bootstrap Blocks 安全漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control disruption vulnerability exists in the WordPress plugin All Bootstrap Blocks, which...