Read the docs

wpengine

Records33All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical5CVSS 9.0–10.0
CVSS high9CVSS 7.0–8.9

Exploited now

wpengine records in CISA KEV

No wpengine vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wpgraphql 5 records HIGH Genesis Blocks 3 records HIGH Advanced Custom Fields 1 record LOW Better Search Replace 1 record CRITICAL Php Compatibility Checker 1 record LOW

Records

3 records in Genesis Blocks · all components

TI-2024-03640 CVE-2024-3901 · GHSA-p2gx-629f-525f

Genesis Blocks <= 3.1.3 - Contributor+ Stored XSS

Priority HIGH 65

The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts (like those with the contributor role) to c…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00577 Published 2025-05-15 No fix listed CWE-79
TI-2024-02572 CVE-2024-2761 · GHSA-p7q5-2qf4-97cw

Genesis Blocks < 3.1.3 - Contributor+ Stored XSS

Priority LOW 31

The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor privileges to conduct Stored XSS attacks.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00665 Published 2024-04-19 Fixed in 3.1.3 CWE-79
TI-2024-03322 CVE-2024-3563 · GHSA-hjv2-rmr7-p354

Genesis Blocks <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes

Priority LOW 28

The Genesis Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sharing block in all versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping o…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00349 Published 2024-07-09 No fix listed CWE-79
Open these records in search →