Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-21
Blockspare - Security Vulnerability (CVE-2026-1242)
The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts.
PLUGIN
Blockspare
CVE-2026-1242
Risk Score
Threat Entry
Updated 2026-06-17
Blockspare - Information Disclosure (CVE-2025-62026)
Insertion of Sensitive Information Into Sent Data vulnerability in Blockspare Blockspare blockspare allows Retrieve Embedded Sensitive Data.This issue affects Blockspare: from n/a through
PLUGIN
Blockspare
CVE-2025-62026
Risk Score
Threat Entry
Updated 2026-06-17
Blockspare - Cross-Site Scripting (XSS) (CVE-2025-4684)
The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image Slider widgets in all versions up to, and including, 3.2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected…
PLUGIN
Blockspare
CVE-2025-4684
Risk Score
Threat Entry
Updated 2026-06-17
Blockspare - Cross-Site Scripting (XSS) (CVE-2025-47495)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blockspare Blockspare blockspare allows Stored XSS.This issue affects Blockspare: from n/a through
PLUGIN
Blockspare
CVE-2025-47495
Risk Score
Threat Entry
Updated 2026-06-17
Blockspare - Cross-Site Scripting (XSS) (CVE-2024-47363)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blockspare Blockspare blockspare allows Stored XSS.This issue affects Blockspare: from n/a through
PLUGIN
Blockspare
CVE-2024-47363
Risk Score
Threat Entry
Updated 2026-06-17
Blockspare - Cross-Site Scripting (XSS) (CVE-2024-8325)
The Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in the ‘blockspare_render_social_sharing_block’ function in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Blockspare
CVE-2024-8325
Risk Score