Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: Mikado-Themes Component: Qi Blocks Clear all filters
TI-2025-01400 CVE-2025-1627 · GHSA-mgxw-4c3p-hwg4

Qi Blocks < 1.4 - Contributor+ Stored XSS via ToC Block

Priority MEDIUM 58

The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00254 Published 2025-05-19 Fixed in 1.4 CWE-79
TI-2025-01399 CVE-2025-1626 · GHSA-rfrq-gwcc-2wcq

Qi Blocks < 1.4 - Contributor+ Stored XSS vi Countdown Block

Priority MEDIUM 58

The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00254 Published 2025-05-19 Fixed in 1.4 CWE-79
TI-2025-01398 CVE-2025-1625 · GHSA-mhq7-845r-m6gh

Qi Blocks < 1.4 - Contributor+ Stored XSS via Counter Block

Priority MEDIUM 58

The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor r…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00294 Published 2025-05-19 Fixed in 1.4 CWE-79
TI-2024-33176 CVE-2024-49690 · GHSA-jfpv-3cc9-x9c2

WordPress Qi Blocks plugin <= 1.3.2 - Local File Inclusion vulnerability

Priority MEDIUM 41

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Qode Qi Blocks qi-blocks.This issue affects Qi Blocks: from n/a through <= 1.3.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00558 Published 2024-10-23 No fix listed CWE-98
TI-2024-25946 CVE-2024-38712 · GHSA-4xhw-j298-f2jr

WordPress Qi Blocks plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks.This issue affects Qi Blocks: from n/a through <= 1.3.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00263 Published 2024-07-20 No fix listed CWE-79
TI-2024-04845 CVE-2024-5221 · GHSA-53r7-4q94-9fmr

Qi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting

Priority LOW 28

The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00252 Published 2024-06-06 No fix listed CWE-79