WordPress plugin Content Blocks (Custom Post Widget) 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-0894: Improper Neutralization of Input During Web Page Generation

The Content Blocks Custom Post Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contentblock shortcode in all versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping on user supplied values consumed from user-created...

WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via content Parameter vulnerability discovered by lowol in WordPress Plugin Content Blocks Custom Post Widget versions = 3.3.5...

CVE-2024-34566

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johan van der Wijk Content Blocks Custom Post Widget allows Stored XSS.This issue affects Content Blocks Custom Post Widget: from n/a through 3.3.0...

CVE-2024-6432: Improper Neutralization of Input During Web Page Generation

The Content Blocks Custom Post Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within the plugin's shortcode Content Block in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it...

PT-2025-7450

Name of the Vulnerable Software and Affected Versions Content Blocks Custom Post Widget plugin for WordPress versions up to, and including, 3.3.5 Description The issue is related to Stored Cross-Site Scripting via the content parameter within the plugin's shortcode Content Block due to insufficie...

CVE-2024-44051

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johan van der Wijk Content Blocks Custom Post Widget custom-post-widget allows Stored XSS.This issue affects Content Blocks Custom Post Widget: from n/a through = 3.3.5...

CVE-2024-44051

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Johan van der Wijk Content Blocks Custom Post Widget allows Stored XSS.This issue affects Content Blocks Custom Post Widget: from n/a through 3.3.5...

CVE-2024-44051

Content Blocks (Custom Post Widget) for WordPress is affected by CVE-2024-44051: a Stored XSS due to improper neutralization in web page generation. Impact is limited to versions

PT-2024-30919 · Unknown · Content Blocks

Name of the Vulnerable Software and Affected Versions: Content Blocks Custom Post Widget versions 3.3.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

CVE-2024-44051: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johan van der Wijk Content Blocks Custom Post Widget custom-post-widget allows Stored XSS.This issue affects Content Blocks Custom Post Widget: from n/a through = 3.3.5...

WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by lowol ngo Patchstack Alliance in WordPress Plugin Content Blocks Custom Post Widget versions = 3.3.5...

WordPress Content Blocks (Custom Post Widget) Plugin <= 3.3.5 is vulnerable to Cross Site Scripting (XSS)

Software Content Blocks Custom Post Widget Type Plugin Vulnerable versions = 3.3.5 Fixed in 3.3.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44051 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b50c32e861c5 Credits lowol ngo Required...

WordPress Content Blocks (Custom Post Widget) Plugin <= 3.3.0 is vulnerable to Local File Inclusion

Software Content Blocks Custom Post Widget Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3564 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 7062c181fd50 Credits Krzysztof Zając Required...

PT-2024-26586

Name of the Vulnerable Software and Affected Versions Content Blocks Custom Post Widget plugin for WordPress versions up to, and including, 3.3.0 Description The issue allows authenticated attackers with contributor-level access and above to include and execute arbitrary files on the server via t...

CVE-2024-3564: Improper Control of Filename for Include/Require Statement in PHP Program

The Content Blocks Custom Post Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the plugin's 'contentblock' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execu...

CVE-2024-3565: Improper Neutralization of Input During Web Page Generation

The Content Blocks Custom Post Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'contentblock' shortcode in all versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-26595

Name of the Vulnerable Software and Affected Versions Content Blocks Custom Post Widget plugin for WordPress versions up to, and including, 3.3.0 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's content block...

CVE-2024-34566

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johan van der Wijk Content Blocks Custom Post Widget allows Stored XSS.This issue affects Content Blocks Custom Post Widget: from n/a through 3.3.0...

CVE-2024-34566 WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johan van der Wijk Content Blocks Custom Post Widget allows Stored XSS.This issue affects Content Blocks Custom Post Widget: from n/a through 3.3.0...