WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.19 is vulnerable to Server Side Request Forgery (SSRF)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.19 Fixed in 3.2.20 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-23500 Patch priority Low CVSS severity Low 7.7 Developer KadenceWP PSID 12733422b1ab...

WordPress Gutenberg Block Editor Toolkit Plugin <= 1.40.3 is vulnerable to Arbitrary File Upload

Software Gutenberg Block Editor Toolkit Type Plugin Vulnerable versions = 1.40.3 Fixed in 1.40.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6635 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID d39ac6b70847 Credits István Márton Required...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Spectra – WordPress Gutenberg Blocks allows Stored XSS.This issue affects Spectra – WordPress Gutenberg Blocks: from n/a through 2.7.9...

WordPress Gutenberg Plugin <= 16.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Type Plugin Vulnerable versions = 16.8.0 Fixed in 16.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-38000 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fc1d5fbe52a2 Credits Rafie Muhammad Patchstack Required...

WordPress Gutenberg Block Editor Toolkit Plugin <= 1.16 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Block Editor Toolkit Type Plugin Vulnerable versions = 1.16 Fixed in 1.17 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID d49173f4b0fb Credits Rafie Muhammad Patchsta...

WordPress Gutenberg plugin <= 14.3.0 - Multiple Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Stored Cross-Site Scripting XSS vulnerabilities via Search, Feature Image, RSS, and Widget blocks were discovered by Alex Concha WP Security team and a third-party audit in the WordPress Gutenberg plugin versions = 14.3.1. Solution Update the WordPress Gutenberg plugin to the latest...

WordPress Gutenberg plugin <= 12.7.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Ben Bidner in WordPress Gutenberg plugin versions = 12.7.1. Solution Update the WordPress Gutenberg plugin to the latest available version at least 12.7.2...

WordPress < 5.9.2 / Gutenberg < 12.7.2 - Prototype Pollution via Gutenberg’s wordpress/url package

Description The @wordpress/url package used in WordPress and the Gutenberg plugin is affected by a Prototype Pollution issue...

Code injection

PHP Everywhere = 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts...