Button Block
Monthly
Stored cross-site scripting in the WordPress plugin Button Block (bPlugins) through version 1.2.7 lets an authenticated low-privilege user persist a script payload through the plugin's block content, which then executes in the browser of any higher-privileged user - typically an administrator or editor - who views or edits the affected page. The provider rates it CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting the requirement for a valid content-authoring account (PR:L) and for a victim to interact with the crafted content (UI:R). Exposure is meaningful mainly on multi-author sites that grant contributor or author roles to untrusted users; single-admin installations face substantially lower real-world risk, and no public exploit has been identified at the time of analysis.
Missing Authorization vulnerability in bPlugins LLC Button Block allows Accessing Functionality Not Properly Constrained by ACLs.1.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LLC Button Block allows Stored XSS.1.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Button Block - Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Button Block - Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block]. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Stored cross-site scripting in the WordPress plugin Button Block (bPlugins) through version 1.2.7 lets an authenticated low-privilege user persist a script payload through the plugin's block content, which then executes in the browser of any higher-privileged user - typically an administrator or editor - who views or edits the affected page. The provider rates it CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting the requirement for a valid content-authoring account (PR:L) and for a victim to interact with the crafted content (UI:R). Exposure is meaningful mainly on multi-author sites that grant contributor or author roles to untrusted users; single-admin installations face substantially lower real-world risk, and no public exploit has been identified at the time of analysis.
Missing Authorization vulnerability in bPlugins LLC Button Block allows Accessing Functionality Not Properly Constrained by ACLs.1.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LLC Button Block allows Stored XSS.1.6. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Button Block - Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The Button Block - Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block]. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.