CVE-2023-4386

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getposts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. ...

CVE-2023-7072

CVE-2023-7072 affects the Post Grid Combo – 36+ Gutenberg Blocks WordPress plugin. All versions up to 2.2.68 expose sensitive data via the get_posts REST API endpoint, allowing unauthenticated access to full draft posts, password-protected posts, and passwords. The issue is an Information Exposur...

CVE-2023-7072: Exposure of Sensitive Information Through Data Queries

The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.68 via the 'getposts' REST API Endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including full draft...

CVE-2023-4386: Deserialization of Untrusted Data

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getposts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. ...