| CVE-2025-54708 | WordPress B Blocks Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability | bPlugins | B Blocks | Medium | 6.5 | 2025-08-14 18:21:47 | Deep Dive |
| CVE-2025-54739 | WordPress Nexter Blocks Plugin <= 4.5.4 - Broken Access Control Vulnerability | POSIMYTH | Nexter Blocks | Medium | 5.3 | 2025-08-14 18:21:38 | Deep Dive |
| CVE-2025-48332 | WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability | PublishPress | Gutenberg Blocks | High | 7.5 | 2025-08-14 10:34:23 | Deep Dive |
| CVE-2025-8059 | B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function | bplugins | bBlocks – Essential Gutenberg Blocks & Patterns Collection | Critical | 9.8 | 2025-08-12 04:25:40 | Deep Dive |
| CVE-2025-6256 | Flex Guten <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter | dragwp | Flex Guten – Multile Blocks | Medium | 6.4 | 2025-08-06 01:45:13 | Deep Dive |
| CVE-2025-4684 | BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets | blockspare | BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor | Medium | 6.4 | 2025-08-01 11:18:55 | Deep Dive |
| CVE-2025-4685 | Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets | gutentor | Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor | Medium | 6.4 | 2025-07-21 07:23:24 | Deep Dive |
| CVE-2025-7340 | HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload | htplugins | HT Contact Form – Drag & Drop Form Builder for WordPress | Critical | 9.8 | 2025-07-15 04:23:42 | Deep Dive |
| CVE-2025-7360 | HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move | htplugins | HT Contact Form – Drag & Drop Form Builder for WordPress | Critical | 9.1 | 2025-07-15 04:23:42 | Deep Dive |
| CVE-2025-7341 | HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion | htplugins | HT Contact Form – Drag & Drop Form Builder for WordPress | Critical | 9.1 | 2025-07-15 04:23:41 | Deep Dive |
| CVE-2025-5678 | Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter | stellarwp | Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium | 6.4 | 2025-07-09 01:44:51 | Deep Dive |
| CVE-2025-49032 | WordPress Gutenberg Blocks plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability | PublishPress | Gutenberg Blocks | Medium | 6.5 | 2025-07-03 12:09:16 | Deep Dive |
| CVE-2024-5647 | Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library | blossomthemes | BlossomThemes Social Feed | Medium | 6.4 | 2025-07-03 09:22:19 | Deep Dive |
| CVE-2025-53284 | WordPress CMS Blocks plugin <= 1.1 - Broken Access Control Vulnerability | pankaj.sakaria | CMS Blocks | Medium | 6.5 | 2025-06-27 13:21:22 | Deep Dive |
| CVE-2025-53202 | WordPress Responsive Blocks plugin <= 2.0.6 - Cross Site Scripting (XSS) Vulnerability | CyberChimps | Responsive Blocks | Medium | 6.5 | 2025-06-27 13:21:01 | Deep Dive |
| CVE-2025-5940 | Osom Blocks <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter | osompress | Osom Blocks | Medium | 6.4 | 2025-06-27 07:22:23 | Deep Dive |
| CVE-2025-50034 | WordPress Enhanced Blocks – Page Builder Blocks for Gutenberg plugin <= 1.4.1 - Broken Access Control Vulnerability | Mahmudul Hasan Arif | Enhanced Blocks – Page Builder Blocks for Gutenberg | Medium | 6.5 | 2025-06-20 15:03:54 | Deep Dive |
| CVE-2025-50041 | WordPress Gutenberg Blocks – ACF Blocks Suite plugin <= 2.6.11 - Cross Site Scripting (XSS) Vulnerability | WP Engine | Gutenberg Blocks – ACF Blocks Suite | Medium | 6.5 | 2025-06-20 15:03:51 | Deep Dive |
| CVE-2025-5234 | Gutenverse News <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via elementId Parameter | jegstudio | Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons | Medium | 6.4 | 2025-06-19 09:23:48 | Deep Dive |
| CVE-2025-49881 | WordPress Responsive Blocks plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability | CyberChimps | Responsive Blocks | Medium | 6.5 | 2025-06-17 15:01:13 | Deep Dive |