WordPress Plugin Vulnerabilities
Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email
Description
The plugin does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.
Proof of Concept
Affects Plugins
Fixed in 2.3.0 References
CVE
Classification
Type
INJECTION
OWASP top 10
CVSS
Miscellaneous
Original Researcher
Amin Guliyev
Submitter
Amin Guliyev
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-12 (about 2 days ago)
Added
2026-10-12 (about 1 day ago)
Last Updated
2026-10-12 (about 1 day ago)
