Ablocks
Monthly
Reflected cross-site scripting in the aBlocks plugin for WordPress (versions through 2.16.0) lets an unauthenticated remote attacker run arbitrary script in a victim's browser by enticing them to open a crafted link, as the malicious input is echoed back in the generated page rather than stored (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation hinges on victim interaction, and the highest-impact scenario is luring a logged-in administrator, whose hijacked browser session can be used to perform privileged actions against the site. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score or known exploitation activity was supplied in the available intelligence.
Privilege escalation in the aBlocks WordPress plugin (Kodezen LLC) through version 2.9.1 allows an authenticated low-privileged user to elevate their permissions due to incorrect privilege assignment. With a CVSS of 8.8 (AV:N/AC:L/PR:L), a subscriber- or contributor-level account can gain elevated capabilities remotely over the network. No public exploit identified at time of analysis; the issue was disclosed by Patchstack.
The aBlocks - WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Table Of Content" Block, specifically in the "markerView" attribute, in all. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Reflected cross-site scripting in the aBlocks plugin for WordPress (versions through 2.16.0) lets an unauthenticated remote attacker run arbitrary script in a victim's browser by enticing them to open a crafted link, as the malicious input is echoed back in the generated page rather than stored (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation hinges on victim interaction, and the highest-impact scenario is luring a logged-in administrator, whose hijacked browser session can be used to perform privileged actions against the site. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score or known exploitation activity was supplied in the available intelligence.
Privilege escalation in the aBlocks WordPress plugin (Kodezen LLC) through version 2.9.1 allows an authenticated low-privileged user to elevate their permissions due to incorrect privilege assignment. With a CVSS of 8.8 (AV:N/AC:L/PR:L), a subscriber- or contributor-level account can gain elevated capabilities remotely over the network. No public exploit identified at time of analysis; the issue was disclosed by Patchstack.
The aBlocks - WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Table Of Content" Block, specifically in the "markerView" attribute, in all. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.