Magazine Blocks Blog Designer Magazine Newspaper Website Builder Page Builder With Posts Blocks Post Grid
Monthly
Authorization bypass in the WordPress plugin Magazine Blocks (Blog Designer, Magazine & Newspaper Website Builder) through version 1.8.6 lets any authenticated user with Contributor-level access or above demote administrator-authored Site Builder templates - header, footer, front page, single, archive, 404 and search - to draft status and substitute their own block content, which is then rendered site-wide. The result is site defacement, phishing content injection and SEO spam on affected sites, with no user interaction required and no non-default configuration beyond having the plugin active and admin-authored templates present to overwrite. Exploitation requires a valid Contributor account (CVSS vector PR:L), so the practical exposure is limited to sites that grant contributor privileges, but the issue is real and should be patched; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) matches a modest-priority hardening fix rather than an emergency.
Stored cross-site scripting in the Magazine Blocks WordPress plugin (wpblockart) through version 1.8.6 lets an authenticated user with contributor-level access or higher store arbitrary JavaScript that executes in the browser of anyone viewing the affected page. The flaw sits in the News Ticker block, where the block's clientId attribute is concatenated into an HTML class attribute inside NewsTicker::render() without esc_attr(), so the payload is persisted in post content rather than reflected. Exploitation requires a valid low-privilege account plus access to the block editor, which limits exposure to multi-author sites with open contributor registration or low-trust editorial roles; no public exploit code, EPSS signal, or CISA KEV entry was identified at time of analysis, and this is a genuine but moderate-priority issue rather than an inflated high-severity finding.
Authorization bypass in the WordPress plugin Magazine Blocks (Blog Designer, Magazine & Newspaper Website Builder) through version 1.8.6 lets any authenticated user with Contributor-level access or above demote administrator-authored Site Builder templates - header, footer, front page, single, archive, 404 and search - to draft status and substitute their own block content, which is then rendered site-wide. The result is site defacement, phishing content injection and SEO spam on affected sites, with no user interaction required and no non-default configuration beyond having the plugin active and admin-authored templates present to overwrite. Exploitation requires a valid Contributor account (CVSS vector PR:L), so the practical exposure is limited to sites that grant contributor privileges, but the issue is real and should be patched; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) matches a modest-priority hardening fix rather than an emergency.
Stored cross-site scripting in the Magazine Blocks WordPress plugin (wpblockart) through version 1.8.6 lets an authenticated user with contributor-level access or higher store arbitrary JavaScript that executes in the browser of anyone viewing the affected page. The flaw sits in the News Ticker block, where the block's clientId attribute is concatenated into an HTML class attribute inside NewsTicker::render() without esc_attr(), so the payload is persisted in post content rather than reflected. Exploitation requires a valid low-privilege account plus access to the block editor, which limits exposure to multi-author sites with open contributor registration or low-trust editorial roles; no public exploit code, EPSS signal, or CISA KEV entry was identified at time of analysis, and this is a genuine but moderate-priority issue rather than an inflated high-severity finding.