Threat Entry Updated 2026-06-17

CVE-2026-6394 - Nexa Blocks Plugin

The Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in versions up to and including 1.1.1. This is due to the import_demo() function accepting a user-supplied URL in the demo_json_file POST parameter and passing it directly to wp_remote_get() without any URL validation or restriction against internal or private network destinations. The nexa_blocks_nonce required for the AJAX action is publicly exposed in the HTML source of any frontend page where the plugin is active via wp_localize_script on…

PLUGIN Nexa Blocks

CVE-2026-6394

MEDIUM CVSS 5.4 2026-05-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-10-02

CVE-2025-8624 - Nexa Blocks Plugin

The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Nexa Blocks

CVE-2025-8624

MEDIUM CVSS 6.4 2025-09-30

Risk Score

Open Full Technical Breakdown