Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Gutenberg Essential Blocks 6.4.0 Clear all filters
TI-2026-11170 CVE-2026-13154 · GHSA-45qh-hqj8-xp45

Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint

Priority HIGH 72

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00434 Published 2026-08-06 Fixed in 6.4.0 CWE-200
TI-2026-11169 CVE-2026-13153 · GHSA-x777-p9m5-h8hq

Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint

Priority HIGH 72

The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauth…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01524 Published 2026-08-06 Fixed in 6.4.0 CWE-200