6 matches found
CVE-2026-15420
The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...
CVE-2026-15420
The CVE-2026-15420 entry concerns Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder for WordPress. Affected component: the WordPress plugin itself (Nexter Blocks) with a Directory Traversal flaw exploitable via the plus_name parameter. Impact: authenticated attackers with subscr...
EUVD-2026-48464
The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...
CVE-2026-15420 Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter
The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...
CVE-2026-15420 Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter
The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...
PT-2026-64229
The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plus name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, ...