CVE-2024-3513

CVE-2024-3513 affects Ultimate Blocks – WordPress Blocks Plugin, where Stored Cross-Site Scripting is possible via the title tag parameter in all versions up to and including 3.1.9. The vulnerability requires authenticated access (contributors or higher) and can let an attacker inject scripts tha...

CVE-2024-3241

The Ultimate Blocks WordPress plugin (versions prior to 3.1.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly validate and escape certain block options before they are outputted back in a page or post where the block is embedded. This flaw allows use...

CVE-2025-2918

CVE-2025-2918 — Ultimate Blocks (WordPress Blocks Plugin) is a stored cross-site scripting vulnerability in the plugin for WordPress, exploitable via multiple widgets. Affected versions: up to and including 3.3.3, with the issue caused by insufficient input sanitization and output escaping. Explo...

CVE-2024-10678

The Ultimate Blocks WordPress plugin, in versions prior to 3.2.4 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to properly validate and escape certain block options before they are outputted back into a page or post where the block is embedded. This f...

CVE-2024-4268

CVE-2024-4268 – Ultimate Blocks (WordPress Blocks Plugin) vulnerable to a Stored XSS in all versions up to 3.1.9 due to insufficient input sanitization and output escaping on user-supplied attributes. Requires authenticated access (Contributor+) to inject scripts that run when users load injected...

CVE-2024-4655

The CVE-2024-4655 entry concerns the Ultimate Blocks WordPress plugin (versions prior to 3.1.9). The issue stems from not validating and escaping certain block options before output, enabling Stored Cross-Site Scripting when a block is embedded in a page or post. Exploitation is possible by an au...

CVE-2024-6362

The Ultimate Blocks WordPress plugin in versions prior to 3.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly validate and escape certain post-grid block attributes before they are outputted back into a page or post where the block is embedded. This ...

CVE-2024-37457

The CVE-2024-37457 pertains to the WordPress plugin “Ultimate Blocks – Gutenberg Blocks”. Affected versions are 3.1.9 and earlier, where the vulnerability arises from Improper Neutralization of Input During Web Page Generation, i.e., a Stored XSS flaw in the plugin. The issue enables stored cross...

CVE-2024-8536

The CVE-2024-8536 entry concerns the Ultimate Blocks WordPress plugin (versions prior to 3.2.2) where unvalidated/unescaped block attributes could lead to Stored XSS when a block is embedded in a post/page. Red Hat and Patchstack corroborate the issue and indicate the fix is in version 3.2.2. The...