| CVE-2025-11841 | Greenshift – animation and page builder blocks <= 12.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes | wpsoul | Greenshift – animation and page builder blocks | Medium | 6.4 | 2025-11-04 01:50:26 | Deep Dive |
| CVE-2025-11270 | Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | wpdevteam | Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns | Medium | 6.4 | 2025-10-18 06:42:48 | Deep Dive |
| CVE-2025-11361 | Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery | wpdevteam | Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns | Medium | 6.4 | 2025-10-18 04:25:57 | Deep Dive |
| CVE-2025-9626 | Page Blocks <= 1.1.0 - Cross-Site Request Forgery | softwud | Page Blocks | Medium | 4.3 | 2025-10-11 09:28:39 | Deep Dive |
| CVE-2025-8624 | Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget | wpdive | Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | Medium | 6.4 | 2025-09-30 03:35:29 | Deep Dive |
| CVE-2025-9992 | Ghost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting | nko | Ghost Kit – Page Builder Blocks, Motion Effects & Extensions | Medium | 6.4 | 2025-09-18 09:31:28 | Deep Dive |
| CVE-2025-4684 | BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets | blockspare | BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor | Medium | 6.4 | 2025-08-01 11:18:55 | Deep Dive |
| CVE-2025-4685 | Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets | gutentor | Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor | Medium | 6.4 | 2025-07-21 07:23:24 | Deep Dive |
| CVE-2025-7340 | HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload | htplugins | HT Contact Form – Drag & Drop Form Builder for WordPress | Critical | 9.8 | 2025-07-15 04:23:42 | Deep Dive |
| CVE-2025-7360 | HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move | htplugins | HT Contact Form – Drag & Drop Form Builder for WordPress | Critical | 9.1 | 2025-07-15 04:23:42 | Deep Dive |
| CVE-2025-7341 | HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion | htplugins | HT Contact Form – Drag & Drop Form Builder for WordPress | Critical | 9.1 | 2025-07-15 04:23:41 | Deep Dive |
| CVE-2025-5678 | Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter | stellarwp | Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium | 6.4 | 2025-07-09 01:44:51 | Deep Dive |
| CVE-2024-5647 | Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library | blossomthemes | BlossomThemes Social Feed | Medium | 6.4 | 2025-07-03 09:22:19 | Deep Dive |
| CVE-2025-50034 | WordPress Enhanced Blocks – Page Builder Blocks for Gutenberg plugin <= 1.4.1 - Broken Access Control Vulnerability | Mahmudul Hasan Arif | Enhanced Blocks – Page Builder Blocks for Gutenberg | Medium | 6.5 | 2025-06-20 15:03:54 | Deep Dive |
| CVE-2025-30951 | WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.36 - Cross Site Scripting (XSS) Vulnerability | Stiofan | BlockStrap Page Builder - Bootstrap Blocks | Medium | 6.5 | 2025-06-06 12:54:12 | Deep Dive |
| CVE-2025-4682 | Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider and Post Carousel Widgets | wpdevteam | Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns | Medium | 6.4 | 2025-05-27 01:48:49 | Deep Dive |
| CVE-2025-3616 | Greenshift 11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Upload | wpsoul | Greenshift – animation and page builder blocks | High | 8.8 | 2025-04-22 04:21:33 | Deep Dive |
| CVE-2025-3276 | SKT Blocks – Gutenberg based Page Builder <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting | sonalsinha21 | SKT Blocks – Gutenberg based Page Builder | Medium | 6.4 | 2025-04-12 06:37:19 | Deep Dive |
| CVE-2025-1664 | Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | wpdevteam | Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns | Medium | 6.4 | 2025-03-08 11:16:40 | Deep Dive |
| CVE-2025-1291 | Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' | stellarwp | Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium | 6.4 | 2025-03-01 08:23:21 | Deep Dive |