Page Builder Gutenberg Blocks Coblocks
Monthly
Stored Cross-Site Scripting in CoBlocks Page Builder plugin for WordPress allows authenticated Contributor-level users to inject malicious scripts via external iCal feed data in the Events block, executing arbitrary JavaScript in pages visited by any user. The vulnerability exists in all versions through 3.1.16 due to insufficient output escaping of event titles, descriptions, and locations. CVSS 6.4 reflects limited direct impact (confidentiality and integrity) but broad scope across WordPress installations, and no public exploit code or active exploitation has been confirmed at this time.
Stored Cross-Site Scripting in CoBlocks Page Builder plugin for WordPress allows authenticated Contributor-level users to inject malicious scripts via external iCal feed data in the Events block, executing arbitrary JavaScript in pages visited by any user. The vulnerability exists in all versions through 3.1.16 due to insufficient output escaping of event titles, descriptions, and locations. CVSS 6.4 reflects limited direct impact (confidentiality and integrity) but broad scope across WordPress installations, and no public exploit code or active exploitation has been confirmed at this time.