CVE-2025-26771

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sonalsinha21 SKT Blocks – Gutenberg based Page Builder allows Stored XSS. This issue affects SKT Blocks – Gutenberg based Page Builder: from n/a through 1.7...

CVE-2025-26771

CVE-2025-26771 is a stored XSS vulnerability in WordPress SKT Blocks – Gutenberg based Page Builder (plugin, versions up to 1.7). Root cause: improper input neutralization during web page generation. Affected: SKT Blocks plugin ≤ 1.7. Impact: stored cross-site scripting as described in multiple s...

PT-2025-7232 · Unknown · Skt Blocks

Name of the Vulnerable Software and Affected Versions: SKT Blocks – Gutenberg based Page Builder versions 1.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored Cross-site Scripting XSS. This means an attacker could...

CVE-2025-26767

CVE-2025-26767 affects WordPress plugin Qubely – Advanced Gutenberg Blocks (versions from n/a through 1.8.12). The issue is caused by improper neutralization of input during web page generation, enabling Stored XSS. Affected component: Qubely blocks code path that renders pages can store maliciou...

CVE-2025-26767 WordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through = 1.8.12...

PT-2025-7228

Name of the Vulnerable Software and Affected Versions: Qubely – Advanced Gutenberg Blocks versions 1.8.12 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored Cross-site Scripting XSS. This enables attackers to inject...

CVE-2024-9601: Improper Neutralization of Input During Web Page Generation

The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2025-25080: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gubbigubbi Kona Gallery Block kona-instagram-feed-for-gutenberg allows Stored XSS.This issue affects Kona Gallery Block: from n/a through = 1.7...

The vulnerability of the Gutenberg module in the Drupal CMS system, which allows a hacker to perform a CSRF attack

The vulnerability of the Gutenberg module in the Drupal CMS system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

CVE-2024-30435

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor.This issue affects Nexter Blocks: from n/a through = 3.2.5...

CVE-2024-23500

Server-Side Request Forgery SSRF vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through = 3.2.19...

CVE-2024-6313

The Gutenberg Forms plugin for WordPress is vulnerable to arbitrary file uploads due to the users can specify the allowed file types in the 'upload' function in versions up to, and including, 2.2.9. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

CVE-2024-44007

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sonalsinha21 SKT Templates – Elementor & Gutenberg templates skt-templates allows Reflected XSS.This issue affects SKT Templates – Elementor & Gutenberg templates: from n/a through = 6.14...

PT-2025-2200 · WordPress · B Slider- Gutenberg Slider Block

Name of the Vulnerable Software and Affected Versions: The B Slider- Gutenberg Slider Block for WP plugin for WordPress versions up to, and including, 1.9.5 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private posts they should...

CVE-2024-13514: Improper Access Control

The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.5 via the 'bsb-slider' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, wi...

CVE-2024-13733: Improper Neutralization of Input During Web Page Generation

The SKT Blocks – Gutenberg based Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's skt-blocks/post-carousel block in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This...

WordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gab in WordPress Plugin Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce versions = 1.4.4...

CVE-2024-12620: Missing Authorization

The AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'agljson' AJAX action in all versions up to, and including, 1.4.23. This makes it possible for...

WordPress AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations plugin <= 1.4.23 - Missing Authorization to Unauthenticated Settings Update vulnerability

Missing Authorization to Unauthenticated Settings Update vulnerability discovered by Lucio Sá in WordPress Plugin AnimateGL - Advanced Animation Plugin for WordPress versions = 1.4.23...

WordPress Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin <= 2.7.7.24 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin Photo Gallery versions = 2.7.7.24...