CVE-2023-4386

The Essential Blocks plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.2.0 via deserialization of untrusted input in the getposts function. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. ...

CVE-2023-7072

CVE-2023-7072 affects the Post Grid Combo – 36+ Gutenberg Blocks WordPress plugin. All versions up to 2.2.68 expose sensitive data via the get_posts REST API endpoint, allowing unauthenticated access to full draft posts, password-protected posts, and passwords. The issue is an Information Exposur...