All Bootstrap Blocks
Monthly
Local file inclusion that can escalate to PHP code execution affects the All Bootstrap Blocks WordPress plugin in versions up to and including 1.3.31, allowing an authenticated user with contributor-level access or higher to direct the plugin to include arbitrary local files at render time and read their contents. Code execution occurs only where an includable local file already contains PHP, and exploitation additionally requires the plugin's non-default Lightspeed subsystem to be explicitly enabled, so a stock installation is not exposed. No CISA KEV entry has been recorded for this issue, but publicly available exploit code exists and a proof-of-concept is referenced by WPScan, making the risk material for sites that have enabled Lightspeed and grant contributor accounts.
Stored cross-site scripting in the All Bootstrap Blocks WordPress plugin (all versions through 1.3.31) lets an authenticated user with Contributor-level access or above plant a malicious block attribute that the plugin writes into HTML tag-name position without escaping, so arbitrary JavaScript runs in the browser of anyone who later views the affected content. Publicly available exploit code exists, and the vendor's own advisory is linked from WPScan, but there is no evidence of active exploitation (no CISA KEV entry) and the plugin has a small deployment footprint, making real-world impact narrower than the headline CVSS 6.8 (Medium) suggests. Because exploitation requires a low-privilege account plus a second user triggering the view, this is best treated as a Contributor-gated stored XSS rather than a remotely exploitable, unauthenticated flaw.
The All Bootstrap Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Accordion" widget in all versions up to, and including, 1.3.26 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in AREOI All Bootstrap Blocks plugin <= 1.3.6 versions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local file inclusion that can escalate to PHP code execution affects the All Bootstrap Blocks WordPress plugin in versions up to and including 1.3.31, allowing an authenticated user with contributor-level access or higher to direct the plugin to include arbitrary local files at render time and read their contents. Code execution occurs only where an includable local file already contains PHP, and exploitation additionally requires the plugin's non-default Lightspeed subsystem to be explicitly enabled, so a stock installation is not exposed. No CISA KEV entry has been recorded for this issue, but publicly available exploit code exists and a proof-of-concept is referenced by WPScan, making the risk material for sites that have enabled Lightspeed and grant contributor accounts.
Stored cross-site scripting in the All Bootstrap Blocks WordPress plugin (all versions through 1.3.31) lets an authenticated user with Contributor-level access or above plant a malicious block attribute that the plugin writes into HTML tag-name position without escaping, so arbitrary JavaScript runs in the browser of anyone who later views the affected content. Publicly available exploit code exists, and the vendor's own advisory is linked from WPScan, but there is no evidence of active exploitation (no CISA KEV entry) and the plugin has a small deployment footprint, making real-world impact narrower than the headline CVSS 6.8 (Medium) suggests. Because exploitation requires a low-privilege account plus a second user triggering the view, this is best treated as a Contributor-gated stored XSS rather than a remotely exploitable, unauthenticated flaw.
The All Bootstrap Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Accordion" widget in all versions up to, and including, 1.3.26 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-Site Request Forgery (CSRF) vulnerability in AREOI All Bootstrap Blocks plugin <= 1.3.6 versions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.