CVE-2024-10124-Poc

CVE-2024-10124-Poc Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 플러그인은 1.1.1 이하 모든 버전에서 tpinstall 함수에 대한 기능capability 확인이 누락되어 있어, 인증되지 않은 공격자가 임의의 플러그인을 설치하고 활성화할 수 있습니다. 이 취약점을 악용하여 다른 취약한 플러그인이 설치 및 활성화되어 있다면 원격 코드 실행까지 달성할 수 있습니다. 이 취약점은 1.1.1 버전에서 부분적으로 패치되었습니다. 예시 시나리오 취약점 확인...

PoC_CVE-2025-2568

PoC CVE-2025-2568 개요 WordPress 및 WooCommerce용 Vayu Blocks – Gutenberg Blocks 플러그인은 1.0.4부터 1.2.1까지의 버전에서 vayublocksgettoggleswitchvaluescallback 및 vayublockssavetoggleswitchcallback 함수에 기능 검사가 누락되어 무단 액세스 및 데이터 수정 에 취약합니다. 이로 인해 인증되지 않은 공격자가 플러그인 옵션을 읽고 value로 끝나는 키 이름을 가진 모든 옵션을 업데이트할 수 있습니다. 공격...

CVE-2024-10124

CVE-2024-10124 Vayu Blocks – WordPress 및 WooCommerce용 Gutenberg 블록 = 1.1.1 - 인증되지 않은 임의 플러그인 설치/활성화를 위한 권한 누락 설명 WordPress용 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 플러그인은 1.1.1 버전을 포함한 모든 버전에서 tpinstall 함수에 대한 기능 검사가 누락되어 인증되지 않은 임의의 플러그인 설치 및 활성화에 취약합니다. 이로 인해 인증되지 않은 공격자가 임의의...

WordPress Vayu Blocks plugin <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary plugin Installation/Activation vulnerability

Missing Authorization to Unauthenticated Arbitrary plugin Installation/Activation vulnerability discovered by stealthcopter in WordPress Plugin Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce versions = 1.1.1...

EUVD-2025-8474

Malicious code in bioql PyPI...

EUVD-2025-10317

Malicious code in bioql PyPI...

CVE-2025-9378

The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie block in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-9378 Vayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes

The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie block in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-9378

CVE-2025-9378 concerns the WordPress plugin Vayu Blocks – Website Builder for the Block Editor (versions up to 1.3.9). The vulnerability is a Stored Cross-Site Scripting issue in the Lottie block, arising from insufficient input sanitization and output escaping. An authenticated attacker with Con...

WordPress plugin Vayu Blocks 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Vayu Blocks plugin <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Block Attributes vulnerability discovered by WordFence in WordPress Plugin Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce versions = 1.3.9...

CVE-2025-4420

The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerWidth’ parameter in all versions up to, and including, 1.3.1 due to a missing capability check on the vayublocksoptionpanelcallback function and...

CVE-2025-4420

The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerWidth’ parameter in all versions up to, and including, 1.3.1 due to a missing capability check on the vayublocksoptionpanelcallback function and...

CVE-2025-4420 Vayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter

The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerWidth’ parameter in all versions up to, and including, 1.3.1 due to a missing capability check on the vayublocksoptionpanelcallback function and...

CVE-2025-4420 Vayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter

The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘containerWidth’ parameter in all versions up to, and including, 1.3.1 due to a missing capability check on the vayublocksoptionpanelcallback function and...

CVE-2025-4420

CVE-2025-4420 affects the WordPress plugin “Vayu Blocks – Website Builder for the Block Editor” (Vayu Blocks) up to version 1.3.1. It enables a stored XSS via the containerWidth parameter due to a missing capability check in vayu_blocks_option_panel_callback() and insufficient input sanitization/...

PT-2025-23592 · WordPress · Vayu Blocks

Name of the Vulnerable Software and Affected Versions: Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress version 1.3.1 and earlier Description: The issue is related to Stored Cross-Site Scripting via the containerWidth parameter. This is due to a missing capability...

WordPress plugin Vayu Blocks 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Vayu Blocks plugin <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter vulnerability

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting via containerWidth Parameter vulnerability discovered by Chuck in WordPress Plugin Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce versions = 1.3.1...

CVE-2025-2568

The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the 'vayublocksgettoggleswitchvaluescallback' and 'vayublockssavetoggleswitchcallback' function in versions 1.0.4 t...