CVE-2026-102002

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.2.6 . The root cause lies in the 'otter_form_widget_filter' parameter, which allows authenticated attackers with ...

CVE-2026-102002 Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-91247

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otterformwidgetfilter' parameter. This makes it possible for authenticated attackers, with...

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by vta.itsec in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.11.1...

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion 이 플러그인은 REST API를 통해 템플릿을 렌더링할 때 인증되지 않은 공격자가 로컬 변수를 덮어쓰는 것을 방지하지 않으며, 이로 인해 로컬 파일 포함Local File Inclusion 공격이 발생할 수 있습니다. 사용법: usage: PoC.py -h -u URL -p PAYLOAD Essential Blocks 4.4.3 - Unauthenticated Local File Inclusion options: -h...

CVE-2024-10124-Poc

CVE-2024-10124-Poc Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 플러그인은 1.1.1 이하 모든 버전에서 tpinstall 함수에 대한 기능capability 확인이 누락되어 있어, 인증되지 않은 공격자가 임의의 플러그인을 설치하고 활성화할 수 있습니다. 이 취약점을 악용하여 다른 취약한 플러그인이 설치 및 활성화되어 있다면 원격 코드 실행까지 달성할 수 있습니다. 이 취약점은 1.1.1 버전에서 부분적으로 패치되었습니다. 예시 시나리오 취약점 확인...

Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Bad Plugins vulnerability (USN-8855-1)

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8855-1 advisory. It was discovered that GStreamer Bad Plugins incorrectly validated the size of multi-channel audio...

PT-2026-104118

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter form widget filter' parameter. This makes it possible for authenticated attackers, with...

WordPress Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget vulnerability

Authenticated Subscriber+ Sensitive Information Exposure in Form Submissions Dashboard Widget vulnerability discovered by Jakub Herman in WordPress Plugin Otter - Gutenberg Block versions = 3.2.6...

PoC_CVE-2025-2568

PoC CVE-2025-2568 概要 WordPress 用プラグイン Vayu Blocks – Gutenberg Blocks （WordPress & WooCommerce 向け）は、バージョン 1.0.4 から 1.2.1 において、vayublocksgettoggleswitchvaluescallback および vayublockssavetoggleswitchcallback 関数に権限チェックが欠如しているため、不正アクセス およびデータ改ざん に対して脆弱です。これにより、認証されていない攻撃者がプラグインのオプションを読み取り、キー名が value...

CVE-2026-1560-Authenticated-Remote-Code-Execution-in-Lazy-Blocks-4.2.0

CVE-2026-1560 – 自定义区块构建器（Custom Block Builder）– Lazy Blocks ≤ 4.2.0 中的认证远程代码执行漏洞 研究员 : ZeYrOXxx 插件 : 自定义区块构建器 – Lazy Blocks 受影响版本 : ≤ 4.2.0 严重性 : 高 CVSS : 8.8 漏洞类型 : 认证远程代码执行（RCE） 攻击向量 : REST API 所需权限 : editposts（贡献者及以上） 参考 Wordfence 公告:...

gr-qradiolink

gr-qradiolink 重要なお知らせ : これはAIが生成したコードです。 このコードはプロのコーダーによるレビューを受けておらず、大規模なタスクです。コードベースにはテストが用意されていますので、それらとそのコードを確認してください。 GNU Radio out-of-tree OOTモジュール for QRadioLink blocks. ブランチmain: GNU Radio 3.10 OOT CMake findpackagegnuradio. 実験的なGNU Radio 4 ポートはブランチ gnuradio4 にあります（そのブランチのREADMEgr4.md）。...

CVE-2026-96256

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping ...

EUVD-2026-90594

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping ...

CVE-2026-96256

The Gutenberg Essential Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 6.4.5 . The flaw resides in the Google Map block's 'marker' attribute due to inadequate input sanitization and output escaping of marker title and content values....

CVE-2026-96256 Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping ...

WordPress Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Essential Blocks for Gutenberg versions = 6.4.5...

USN-8855-1: GStreamer Bad Plugins vulnerability

It was discovered that GStreamer Bad Plugins incorrectly validated the size of multi-channel audio blocks. An attacker could possibly use this issue with a specially crafted WAV file to cause the program to crash, resulting in a denial of service, or possibly execute arbitrary code...

Uncontrolled Resource Consumption

zstd-jni is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper validation of negative length parameters in ZstdInputStreamNoFinalizer.read, which allows an attacker to trigger an infinite loop that holds the stream monitor and blocks other threads from accessing...

EUVD-2026-88559

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...