Vulnerabilities

TI-2026-05612 CVE-2026-6394 · GHSA-88c3-g468-4jgg

Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter

LOW 24

The Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in versions up to and including 1.1.1.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00316 Published 2026-05-20 No fix listed CWE-918

TI-2026-20545 CVE-2026-25429 · GHSA-p9qh-h9cj-hc7v

WordPress Nexa Blocks plugin <= 1.1.1 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00389 Published 2026-03-25 No fix listed CWE-502

TI-2026-02130 CVE-2026-2503 · GHSA-r7mg-x5pg-j8pc

ElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter

LOW 28

The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX action in all versions up to, and including, 2.3.6.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00256 Published 2026-03-21 No fix listed CWE-89

TI-2026-19796 CVE-2026-24556 · GHSA-qh26-rq9g-rc5j

WordPress ElementCamp plugin <= 2.3.2 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in wpdive ElementCamp element-camp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementCamp: from n/a through <= 2.3.2.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00254 Published 2026-01-23 No fix listed CWE-862

TI-2023-22081 CVE-2023-41656 · GHSA-5884-m867-xg58

WordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in wpdive Better Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Elementor Addons: from n/a through 1.3.7.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00244 Published 2025-12-29 No fix listed CWE-862

TI-2025-11752 CVE-2025-12830 · GHSA-x2g3-qcv6-fm9w

Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget

LOW 34

The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider widget in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping o…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00232 Published 2025-12-12 No fix listed CWE-79

TI-2025-07895 CVE-2025-8624 · GHSA-qcvf-gqwj-hw7c

Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget

LOW 28

The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00246 Published 2025-09-30 No fix listed CWE-79

TI-2025-22222 CVE-2025-30952 · GHSA-hxxj-pgmw-p98q

WordPress Nexa Blocks plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdive Nexa Blocks nexa-blocks allows Stored XSS.This issue affects Nexa Blocks: from n/a through <= 1.1.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00269 Published 2025-06-06 No fix listed CWE-79

TI-2025-22246 CVE-2025-30976 · GHSA-hjfc-fr87-qrcw

WordPress Nexa Blocks plugin <= 1.1.1 - Server Side Request Forgery (SSRF) vulnerability

LOW 22

Server-Side Request Forgery (SSRF) vulnerability in wpdive Nexa Blocks nexa-blocks allows Server Side Request Forgery.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

CVSS 3.1MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00232 Published 2025-06-06 No fix listed CWE-918

TI-2022-04562 CVE-2022-4974 · GHSA-p5fp-r7v7-h5q7

Freemius SDK <= 2.4.2 - Missing Authorization Checks

LOW 28

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_de…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00442 Published 2024-10-16 Fixed in 2.0.2, 1.9.8 +273 CWE-862

Vulnerabilities

Filters