Magazine Blocks
Monthly
Cross-site scripting in ThemeGrill's Magazine Blocks WordPress plugin (versions ≤1.8.6) enables an authenticated Contributor to inject malicious scripts into block content that execute in a victim's browser upon page view. The CVSS scope-change metric (S:C) reflects that injected code escapes the plugin context and runs in the victim's browser session, potentially allowing session token theft or unauthorized admin actions. No public exploit code or active exploitation has been identified at time of analysis, but the Patchstack-reported flaw and ENISA EUVD-2026-64788 entry confirm the vulnerability.
An authorization bypass in BlockArt Magazine Blocks for WordPress (≤1.8.3) lets authenticated users with lower privileges perform unauthorized data modifications. The vulnerability is not known to be actively exploited, and exploitation probability is assessed as low (EPSS 0.02%). The issue stems from missing capability checks that allow modified data access without proper permission verification.
The Magazine Blocks - Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site scripting in ThemeGrill's Magazine Blocks WordPress plugin (versions ≤1.8.6) enables an authenticated Contributor to inject malicious scripts into block content that execute in a victim's browser upon page view. The CVSS scope-change metric (S:C) reflects that injected code escapes the plugin context and runs in the victim's browser session, potentially allowing session token theft or unauthorized admin actions. No public exploit code or active exploitation has been identified at time of analysis, but the Patchstack-reported flaw and ENISA EUVD-2026-64788 entry confirm the vulnerability.
An authorization bypass in BlockArt Magazine Blocks for WordPress (≤1.8.3) lets authenticated users with lower privileges perform unauthorized data modifications. The vulnerability is not known to be actively exploited, and exploitation probability is assessed as low (EPSS 0.02%). The issue stems from missing capability checks that allow modified data access without proper permission verification.
The Magazine Blocks - Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.