CVE-2021-24661 PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Private Content Disclosure

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID...

CVE-2021-24661

The PostX – Gutenberg Blocks for Post Grid WordPress plugin (before 2.4.10) with the Saved Templates Addon enabled permits users with Contributor roles or higher to read password-protected or private post contents they normally cannot access, given a post ID. This is the confirmed issue described...

CVE-2021-24660 PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode...

CVE-2021-24660

CVE-2021-24660 affects the WordPress plugin pair: PostX – Gutenberg Blocks for Post Grid with the Saved Templates Addon enabled, versions before 2.4.10. The vulnerability is a Stored Cross-Site Scripting (XSS) via the plugin’s shortcode, allowing users with a role as low as Contributor to inject ...

CVE-2021-24659 PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block...

CVE-2021-24652 PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values...

CVE-2021-24652

CVE-2021-24652 (PostX – Gutenberg Blocks for Post Grid) affects the WordPress plugin PostX – Gutenberg Blocks for Post Grid, prior to version 2.4.10. The vulnerability arises from missing/incorrect access controls in certain AJAX requests, allowing any logged-in user to modify, delete, or add val...

WordPress Getwid – Gutenberg Blocks plugin <= 1.7.4 - Authenticated Information Disclosure vulnerability

Authenticated Information Disclosure vulnerability discovered in WordPress Getwid – Gutenberg Blocks plugin versions = 1.7.4. Solution Update the WordPress Getwid – Gutenberg Blocks plugin to the latest available version at least 1.7.7...

WordPress Getwid – Gutenberg Blocks plugin <= 1.7.4 - Cross-Site Request Forgery (CSRF) / Settings Change vulnerability

Cross-Site Request Forgery CSRF / Settings Change vulnerability discovered in WordPress Getwid – Gutenberg Blocks plugin versions = 1.7.4. Solution Update the WordPress Getwid – Gutenberg Blocks plugin to the latest available version at least 1.7.7...

CVE-2021-24637

The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType combined with content, align, color, variant and fontID argument of a...

CVE-2021-24640

The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

CVE-2021-24637

The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType combined with content, align, color, variant and fontID argument of a...

CVE-2021-24640

The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

CVE-2021-24637 Fonts Plugin < 3.0.3 - Contributor+ Stored Cross-Site Scripting

The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType combined with content, align, color, variant and fontID argument of a...

Gutenberg PDF Viewer Block < 1.0.1 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its block, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. PoC...

WordPress Gutenberg PDF Viewer Block plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Gutenberg PDF Viewer Block plugin versions = 1.0. Solution Update the WordPress Gutenberg PDF Viewer Block plugin to the latest available version at least 1.0.1...

Gutenberg PDF Viewer Block < 1.0.1 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its block, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

Gutenberg Template Library & Redux Framework Plugin for WordPress < 4.2.13 Incorrect Authorization

The WordPress Gutenberg Template Library & Redux Framework Plugin installed on the remote host is affected by an incorrect authorization vulnerability leading to arbitrary plugin installation and post deletion. Note that the scanner has not tested for these issues but has instead relied only on t...

Find My Blocks < 3.4.0 - Private Post Titles Disclosure

The plugin does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles. Create a private post with at least one Gutenburg paragraph block and go to https://example.com/wp-json/find-my-blocks/blocks/?name=core/paragraph...

WordPress Gutenberg Block Editor Toolkit plugin <= 1.31.5 - Arbitrary PHP Code Execution vulnerability

Arbitrary PHP Code Execution vulnerability discovered by bl4derunner in WordPress Gutenberg Block Editor Toolkit plugin versions = 1.31.5. Solution Update the WordPress Gutenberg Block Editor Toolkit plugin to the latest available version at least 1.31.6...