Threat Entry Updated 2026-01-08

CVE-2025-12449 - Wordpress Gutenberg Blocks Plugin

The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to missing capability checks on multiple AJAX actions in all versions up to, and including, 2.4.0. This makes it possible for authenticated attackers, with subscriber level access and above, to read plugin settings including block visibility, maintenance mode configuration, and third-party email marketing API keys, as well as read sensitive configuration data including API keys for email marketing services.

PLUGIN Wordpress Gutenberg Blocks

CVE-2025-12449

MEDIUM CVSS 5.4 2026-01-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-03-27

CVE-2025-1784 - Wordpress Gutenberg Blocks Plugin

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wordpress Gutenberg Blocks

CVE-2025-1784

MEDIUM CVSS 6.4 2025-03-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-21

CVE-2024-13465 - Wordpress Gutenberg Blocks Plugin

The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Table Of Content" Block, specifically in the "markerView" attribute, in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wordpress Gutenberg Blocks

CVE-2024-13465

MEDIUM CVSS 6.4 2025-02-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-01-31

CVE-2024-13732 - Wordpress Gutenberg Blocks Plugin

The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘section_tag’ parameter in all versions up to, and including, 1.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wordpress Gutenberg Blocks

CVE-2024-13732

MEDIUM CVSS 6.4 2025-01-30

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-03-01

CVE-2024-12268 - Wordpress Gutenberg Blocks Plugin

The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'responsive-block-editor-addons/portfolio' block in all versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wordpress Gutenberg Blocks

CVE-2024-12268

MEDIUM CVSS 6.4 2024-12-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-07

CVE-2024-10484 - Wordpress Gutenberg Blocks Plugin

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wordpress Gutenberg Blocks

CVE-2024-10484

MEDIUM CVSS 6.4 2024-12-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-07

CVE-2024-4366 - Wordpress Gutenberg Blocks Plugin

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘block_id’ parameter in versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wordpress Gutenberg Blocks

CVE-2024-4366

MEDIUM CVSS 6.4 2024-05-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-07

CVE-2024-1815 - Wordpress Gutenberg Blocks Plugin

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Gallery block in all versions up to, and including, 2.12.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wordpress Gutenberg Blocks

CVE-2024-1815

MEDIUM CVSS 6.4 2024-05-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-07

CVE-2024-1814 - Wordpress Gutenberg Blocks Plugin

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial block in all versions up to, and including, 2.12.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wordpress Gutenberg Blocks

CVE-2024-1814

MEDIUM CVSS 6.4 2024-05-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-06

CVE-2024-3107 - Wordpress Gutenberg Blocks Plugin

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_default_attributes function. This allows authenticated attackers, with contributor-level permissions and above, to read the contents of any files named attributes.php on the server, which can contain sensitive information.

PLUGIN Wordpress Gutenberg Blocks

CVE-2024-3107

MEDIUM CVSS 4.3 2024-05-02

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-06

CVE-2023-6486 - Wordpress Gutenberg Blocks Plugin

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS metabox in all versions up to and including 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Wordpress Gutenberg Blocks

CVE-2023-6486

MEDIUM CVSS 6.4 2024-04-09

Risk Score

Open Full Technical Breakdown