Plugin icon

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid

magazine-blocks

Vulnerabilities:

9

Last Updated:

September 14, 2026

Active Installs:

6000

Published
Title
Fixed in
CVSS
Published
2026-09-17
Title
Magazine Blocks < 1.8.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint
Fixed in
Fixed in 1.8.7
CVSS
2.7 (low)
Published
2026-09-17
Title
Magazine Blocks < 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute
Fixed in
Fixed in 1.8.7
CVSS
5.5 (medium)
Published
2026-08-24
Title
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid < 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.8.7
CVSS
5.5 (medium)
Published
2026-06-26
Title
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid < 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.8.4
CVSS
5.5 (medium)
Published
2026-02-26
Title
Magazine Blocks < 1.8.4 - Missing Authorization
Fixed in
Fixed in 1.8.4
CVSS
4.3 (medium)
Published
2024-12-30
Title
Magazine Blocks < 1.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.21
CVSS
6.4 (medium)
Published
2024-10-24
Title
Magazine Blocks < 1.3.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.18
CVSS
6.4 (medium)
Published
2024-10-01
Title
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid < 1.3.15 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.3.15
CVSS
6.1 (medium)
Published
2024-05-14
Title
Magazine Blocks < 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.3.7
CVSS
6.4 (medium)