Nexter Blocks
Monthly
Stored Cross-Site Scripting in the Nexter Blocks WordPress plugin before 5.0.2 allows any authenticated user with file upload capability (Author role by default) to upload a malicious SVG file containing embedded JavaScript that executes in any victim's browser upon accessing the file. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) and absence from CISA KEV indicate low observed exploitation to date. The NVD-assigned CVSS PR:N conflicts with the description's clear authentication requirement - defenders should treat this as an authenticated vulnerability, which meaningfully narrows real-world exposure.
Nexter Blocks WordPress plugin versions through 4.7.0 expose sensitive system information to unauthenticated remote attackers via an information disclosure vulnerability, allowing retrieval of embedded sensitive data without authentication or user interaction. The CVSS score of 5.3 reflects moderate confidentiality impact with low attack complexity, though the EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation probability at time of analysis.
Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor.2.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored Cross-Site Scripting in the Nexter Blocks WordPress plugin before 5.0.2 allows any authenticated user with file upload capability (Author role by default) to upload a malicious SVG file containing embedded JavaScript that executes in any victim's browser upon accessing the file. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) and absence from CISA KEV indicate low observed exploitation to date. The NVD-assigned CVSS PR:N conflicts with the description's clear authentication requirement - defenders should treat this as an authenticated vulnerability, which meaningfully narrows real-world exposure.
Nexter Blocks WordPress plugin versions through 4.7.0 expose sensitive system information to unauthenticated remote attackers via an information disclosure vulnerability, allowing retrieval of embedded sensitive data without authentication or user interaction. The CVSS score of 5.3 reflects moderate confidentiality impact with low attack complexity, though the EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation probability at time of analysis.
Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor.2.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.