Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: Vektor,Inc. Component: Vk Blocks Clear all filters
TI-2023-05249 CVE-2023-5706 · GHSA-x72p-747c-h6vp

VK Blocks <= 1.63.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block

Priority LOW 29

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all versions up to, and including, 1.63.0.1 due to insufficient input sanitization…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00635 Published 2023-11-22 No fix listed CWE-79
TI-2023-00553 CVE-2023-0584 · GHSA-79ff-w3cv-55fm

VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

Priority LOW 21

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00503 Published 2023-06-03 No fix listed CWE-285
TI-2023-00552 CVE-2023-0583 · GHSA-xrr2-rr4f-w9p3

VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

Priority LOW 21

The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0054 Published 2023-06-03 No fix listed CWE-285
TI-2023-12515 CVE-2023-27925 · GHSA-6q2c-9f56-3h2c

Cross-site scripting in Vektor,Inc. VK Blocks and VK Blocks Pro

Priority LOW 25

Cross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00613 Published 2023-05-23 No fix listed CWE-79
TI-2023-12514 CVE-2023-27923 · GHSA-47m3-mrjf-h78g

Cross-site scripting in Vektor,Inc. VK Blocks and VK Blocks Pro

Priority LOW 25

Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and earlier allows a remote authenticated attacker to inject an arbitrary script.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00613 Published 2023-05-23 No fix listed CWE-79