WordPress plugin Ultimate Blocks security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Ultimate Blocks – WordPress Blocks Plugin plugin <= 3.1.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 4rCanJ0x! Patchstack Alliance in WordPress Plugin Ultimate Blocks versions = 3.1.9...

WordPress Gutenberg Blocks with AI by Kadence WP plugin <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via HTML Data Attributes vulnerability discovered by Webbernaut in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.2.45...

WordPress Elementor – Header, Footer & Blocks Template Plugin <= 1.6.35 is vulnerable to Cross Site Scripting (XSS)

Software Elementor – Header, Footer & Blocks Template Type Plugin Vulnerable versions = 1.6.35 Fixed in 1.6.36 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33933 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cf61ccd0288a Credits wcraft...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.45 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.45 Fixed in 3.2.46 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5819 Patch priority Low CVSS severity Low 6.5 Developer KadenceWP PSID 2dc85ffd3e5f Credits Webbernau...

WordPress Ultimate Blocks – Gutenberg Blocks Plugin Plugin <= 3.1.9 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Blocks – Gutenberg Blocks Plugin Type Plugin Vulnerable versions = 3.1.9 Fixed in 3.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37457 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 909aaa17d385 Credits 4rCanJ0x!...

CVE-2024-5819

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 3.2.45 due to insufficient input sanitization and output escaping on user supplied...

PT-2024-37181 · Kadence Wp · Gutenberg Blocks With Ai By Kadence Wp

Name of the Vulnerable Software and Affected Versions: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress versions up to, and including, 3.2.45 Description: The issue is related to DOM-based Stored Cross-Site Scripting via HTML data attributes due to...

CVE-2024-5424

The Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameters in all versions up to, and including, 3.2.1 due to...

CVE-2024-5424 Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters

The Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameters in all versions up to, and including, 3.2.1 due to...

CVE-2024-5424

CVE-2024-5424 affects Gallery Blocks with Lightbox (WordPress plugin) and is caused by insufficient input sanitization/escaping in the galleryID and className parameters, enabling Stored XSS. The vulnerability is exploitable by authenticated users with Contributor-level access or higher, affectin...

WordPress Newspack Blocks plugin <= 3.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Newspack Blocks versions = 3.0.8...

WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Newspack Blocks versions = 3.0.8...

WordPress Newspack Blocks plugin <= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerability

Contributor+ Arbitrary Directory Deletion vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Newspack Blocks versions = 3.0.8...

WordPress plugin Gallery Blocks with Lightbox security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress Newspack Blocks Plugin <= 3.0.8 is vulnerable to Arbitrary File Upload

Software Newspack Blocks Type Plugin Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-37424 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID dd4273e7b78e Credits Rafie Muhammad Patchstack Required...

WordPress Newspack Blocks Plugin <= 3.0.8 is vulnerable to Arbitrary File Deletion

Software Newspack Blocks Type Plugin Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-37423 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID a16694974ae5 Credits Rafie Muhammad...

WordPress Gallery Blocks with Lightbox Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Gallery Blocks with Lightbox Type Plugin Vulnerable versions = 3.2.1 Fixed in 3.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5424 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9b9f60e381ec Credits Webbernaut...

WordPress Newspack Blocks Plugin <= 3.0.8 is vulnerable to Broken Access Control

Software Newspack Blocks Type Plugin Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37425 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bdb588fe4e59 Credits Rafie Muhammad Patchstack...

WordPress Kadence Blocks Pro plugin < 2.3.8 - Contributor+ Arbitrary Option Access vulnerability

Contributor+ Arbitrary Option Access vulnerability discovered by Scott Kingsley Clark in WordPress Plugin Kadence Blocks Pro versions 2.3.8...