CVE-2024-13798

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 2.3.5. This is due to insufficient verification on form fields. This makes it possible for unauthenticated attackers to create new orders for...

CVE-2024-43155

CVE-2024-43155 is an authenticated Stored XSS vulnerability in PickPlugins ComboBlocks, affecting versions up to 2.2.86. Exploitation requires a Contributor+ privilege and malicious input is stored during web page generation. The issue is publicly reported (Wordfence/WordPress vulnerability data)...