Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: ckp267 Clear all filters
TI-2026-05597 CVE-2026-6378 · GHSA-8p3w-9597-pwh9

Maxi Blocks <= 2.1.9 - Authenticated (Author+) Stored Cross-Site Scripting via Style Card REST API

Priority LOW 28

The Maxi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `/wp-json/maxi-blocks/v1.0/style-card` REST API endpoint in all versions up to, and including, 2.1.9 due to insufficient input san…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00234 Published 2026-05-02 No fix listed CWE-79
TI-2026-01685 CVE-2026-2028 · GHSA-xqqc-58qj-9w8r

Authorization bypass in ckp267 MaxiBlocks Builder | 17,000+ Design Assets, Patterns…

Priority LOW 30

The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxi_remove_custom_image_size' AJAX action in all versions up to, and inclu…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00318 Published 2026-04-24 No fix listed CWE-639
TI-2024-06385 CVE-2024-6885 · GHSA-mrv6-53xm-wqhf

Path traversal in ckp267 MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons &…

Priority LOW 37

The MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maxi_remove_custom_image_size and maxi_add…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01078 Published 2024-07-23 No fix listed CWE-22