Skip to content
OpenAdvisories

Vendor

bfintal

6 known vulnerabilities.

Products

Stackable – Page Builder Gutenberg Blocks 5 Interactions – Create Interactive Experiences in the Block Editor 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-9601

    Stackable <= 3.19.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'save' Parameter

    The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_block_style' endpoint in all versions up to, and including, 3.19.9 due to insufficient input sanitization and output escaping. This…

    bfintal Stackable – Page Builder Gutenberg Blocks Web / CMS
  • Medium 6.4
    CVE-2025-12709

    Interactions – Create Interactive Experiences in the Block Editor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Interactions – Create Interactive Experiences in the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event selectors in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping.…

    bfintal Interactions – Create Interactive Experiences in the Block Editor Web / CMS
  • Medium 6.4
    CVE-2024-12117

    Stackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the Button block in all versions up to, and including, 3.13.11 due to insufficient input sanitization and output escap…

    bfintal Stackable – Page Builder Gutenberg Blocks Web / CMS
  • Medium 5.3
    CVE-2024-8760

    Stackable – Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection

    The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulting i…

    bfintal Stackable – Page Builder Gutenberg Blocks Web / CMS
  • Medium 6.4
    CVE-2024-6296

    Stackable – Page Builder Gutenberg Blocks <= 3.13.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

    The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ parameter in all versions up to, and including, 3.13.1 due to insufficient input sanitization and output escaping. This make…

    bfintal Stackable – Page Builder Gutenberg Blocks Web / CMS
  • Medium 6.4
    CVE-2024-2039

    Stackable – Page Builder Gutenberg Blocks <= 3.12.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Posts Block

    The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post(v2) block title tag in all versions up to, and including, 3.12.11 due to insufficient input sanitization and output escaping on user s…

    bfintal Stackable – Page Builder Gutenberg Blocks Web / CMS