Blockstrap Page Builder Bootstrap Blocks
Monthly
Reflected cross-site scripting (CWE-79) in the BlockStrap Page Builder 'Bootstrap Blocks' plugin for WordPress lets an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) inject script into a page response by persuading a victim to click a crafted link or load an attacker-controlled request against a vulnerable plugin endpoint. All plugin versions up to and including 0.1.58 are affected; the malicious payload executes in the victim's browser within the victim site's origin, enabling session/token theft, forced actions, or content manipulation on the affected site. Exploitation requires user interaction, so there is no automatic or wormable propagation, and no public exploit code or confirmed active exploitation was identified at time of analysis; the risk is concentrated in sites that run the outdated plugin with untrusted visitors.
Reflected cross-site scripting (CWE-79) in the BlockStrap Page Builder 'Bootstrap Blocks' plugin for WordPress lets an unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) inject script into a page response by persuading a victim to click a crafted link or load an attacker-controlled request against a vulnerable plugin endpoint. All plugin versions up to and including 0.1.58 are affected; the malicious payload executes in the victim's browser within the victim site's origin, enabling session/token theft, forced actions, or content manipulation on the affected site. Exploitation requires user interaction, so there is no automatic or wormable propagation, and no public exploit code or confirmed active exploitation was identified at time of analysis; the risk is concentrated in sites that run the outdated plugin with untrusted visitors.