1470 matches found
Post Grid <= 2.2.50 - Information Exposure via REST API
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50. id: CVE-2023-40211 info: name: Post Grid = 2.2.50 - Information Exposure via REST API...
LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure
The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...
cve-2021-38314
CVE-2021-38314 Python Exploit Detail The Gutenberg Template Library & Redux Framework plugin = 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php that were unique to a given site but deterministic and...
CVE-2026-7465-Lab
CVE-2026-7465 - Spectra Gutenberg Blocks Local Lab Local Docker lab for analyzing and reproducing CVE-2026-7465 in the WordPress plugin Spectra Gutenberg Blocks ultimate-addons-for-gutenberg. This lab compares: vuln: Spectra 2.19.25 patched: Spectra 2.19.26 The proof is intentionally least-harm. ...
CVE-2026-84899
The VikWidgetsLoader WordPress plugin before 1.12.0 is vulnerable to a Contributor+ Stored XSS caused by an unsanitised Gutenberg block attribute (class_suffix) being output inside an inline script. Users with the Contributor role can store arbitrary JavaScript that executes in the browser of any...
CVE-2026-84899 VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix
The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...
-CVE-2026-7465
-CVE-2026-7465 CVE-2026-7465 Spectra Gutenberg Blocks Authenticated RCE Exploit...
EUVD-2026-69856
The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the editposts capability Contributor and above delete or modify custom widget skins via a crafted request, provided they can...
WordPress JetStyleManager for Gutenberg plugin < 1.3.9 - Skin Deletion and Modification vulnerability
Skin Deletion and Modification vulnerability discovered by Huynh Kien Minh in WordPress Plugin JetStyleManager for Gutenberg versions 1.3.9...
WordPress RT Mega Menu plugin < 1.5.2 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Shivamani Vastrala in WordPress Plugin RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions 1.5.2...
CVE-2026-73361
Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...
CVE-2026-66639
Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...
EUVD-2026-60785
Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...
CVE-2026-73361
Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...
CVE-2026-66639
WPZOOM Forms – Contact Form Plugin for Gutenberg (WordPress) contains a Contributor Cross Site Scripting (XSS) vulnerability affecting versions
CVE-2026-66639
Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...
EUVD-2026-60924
Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...
CVE-2026-66639 WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...
WordPress WPZOOM Forms – Contact Form Plugin for Gutenberg plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WPZOOM Forms – Contact Form Plugin for Gutenberg versions = 2.0.7...
