72 matches found
CVE-2026-75017
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized t...
CVE-2026-75016
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render method, which concatenates the...
CVE-2026-75017
CVE-2026-75017 affects the Magazine Blocks WordPress plugin in all versions up to and including 1.8.6 . The vulnerability is an authorization bypass caused by the mzb-builder-template post type being registered with capability_type='post' and exposed via the REST API, allowing any user with Contr...
EUVD-2026-82728
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized t...
CVE-2026-75017 Magazine Blocks <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized t...
EUVD-2026-82744
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render method, which concatenates the...
CVE-2026-75016
The Magazine Blocks plugin for WordPress (versions up to and including 1.8.6 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the NewsTicker::render() method. The root cause is insufficient input sanitization and output escaping: the clientId block attribute is concatenated i...
CVE-2026-75016 Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render method, which concatenates the...
CVE-2026-75017: Missing Authorization
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized t...
CVE-2026-75016: Improper Neutralization of Input During Web Page Generation
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render method, which concatenates the...
WordPress Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover vulnerability
Missing Authorization to Authenticated Contributor+ Arbitrary Post Modification / Site-Wide Template Takeover vulnerability discovered by Wordfence PRISM in WordPress Plugin Magazine Blocks versions = 1.8.6...
WordPress Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Magazine Blocks versions = 1.8.6...
CVE-2026-78290
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...
CVE-2026-78290 WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...
CVE-2026-78290 WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...
CVE-2026-78290
CVE-2026-78290 is a Contributor-level Cross-Site Scripting (XSS) vulnerability in the WordPress Magazine Blocks plugin , affecting versions ≤ 1.8.6 . The vulnerability requires a user with Contributor privileges and user interaction, with a Changed Scope impact (CVSS 3.1 base score 6.5 MEDIUM ). ...
EUVD-2026-64788
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...
WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by sungbyeongchan in WordPress Plugin Magazine Blocks versions = 1.8.6...
