WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
blockspare
Published
2024-09-03
Title
Gutenberg Page Builder Blocks & Ready-Made Patterns Library < 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
blockspare
Published
2024-09-30
Title
Blockspare < 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
blockspare
Published
2025-05-07
Title
Blockspare < 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
blockspare
Published
2025-07-31
Title
BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites < 3.2.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets
Slug
blockspare
Published
2025-10-16
Title
Blockspare < 3.2.14 - Authenticated (Contributor+) Sensitive Information Exposure
Slug
blockspare
Published
2026-04-30
Title
Freemius < 2.11.0 - Reflected DOM-Based XSS via url Parameter
Slug
blockspare
Published
2026-09-18
Title
BlockSpare - Gutenberg Site Builder Blocks & Starter Sites < 5.0.0 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation
Slug
blockstrap-page-builder-blocks
Published
2025-06-05
Title
BlockStrap Page Builder - Bootstrap Blocks < 0.1.37 - Contributor+ Stored XSS
Slug
blockstrap-page-builder-blocks
Published
2026-10-03
Title
BlockStrap Page Builder – Bootstrap Blocks < 0.1.59 - Unauthenticated Stored Cross-Site Scripting
Slug
blocksy-companion
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
blocksy-companion
Published
2023-01-27
Title
Blocksy Companion < 1.8.68 - Contributor+ Stored XSS
Slug
blocksy-companion
Published
2023-04-10
Title
Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access
Slug
blocksy-companion
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
blocksy-companion
Published
2024-03-21
Title
Blocksy Companion < 2.0.32 - Contributor+ Stored XSS
Slug
blocksy-companion
Published
2024-04-10
Title
Blocksy Companion < 2.0.29 - Cross-Site Request Forgery
Slug
blocksy-companion
Published
2024-05-10
Title
Blocksy Companion < 2.0.46 - Contributor+ Stored Cross-Site Scripting via SVG Uploads
Slug
blocksy-companion
Published
2024-05-30
Title
Blocksy Companion < 2.0.43 - Authenticated (Admin+) Server-Side Request Forgery
Slug
blocksy-companion
Published
2025-09-16
Title
Blocksy Companion < 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode
Slug
blocksy-companion
Published
2025-10-06
Title
Blocksy Companion < 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
blocksy-companion
Published
2025-11-10
Title
Blocksy Companion < 2.1.20 - Author+ Arbitrary File Upload via SVG Upload Bypass
Slug
blocksy-companion
Published
2026-06-18
Title
Blocksy Companion < 2.1.46 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter
Slug
blocksy-companion
Published
2026-08-31
Title
Blocksy Companion < 2.1.52 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)
Slug
blocksy-companion
Published
2026-09-24
Title
Blocksy Companion < 2.1.56 - Missing Authorization
Slug
blocksy-companion
Published
2026-10-09
Title
Blocksy Companion < 2.1.59 - Unauthenticated Privilege Escalation via the 'role' Parameter
Slug
blocksy-companion
Published
2026-10-30
Title
Blocksy Companion < 2.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting