wpdive

9 results · Clear filters · Feed

• Medium 5.4
  CVE-2026-6394

  Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter

  The Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in versions up to and including 1.1.1. This is due to the import_demo() function accepting a user-supplied URL…

  wpdive Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Web / CMS
  May 20, 2026
• Medium 6.5
  CVE-2026-2503

  ElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter

  The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX action in all versions up to, and including, 2.3.6. This is due to the user-supplied compare value bei…

  wpdive ElementCamp Web / CMS
  Mar 21, 2026
• Medium 5.3
  CVE-2026-24556

  WordPress ElementCamp plugin <= 2.3.2 - Broken Access Control vulnerability

  Missing Authorization vulnerability in wpdive ElementCamp element-camp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementCamp: from n/a through <= 2.3.2.

  wpdive ElementCamp
  Jan 23, 2026
• Medium 5.4
  CVE-2023-41656

  WordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerability

  Missing Authorization vulnerability in wpdive Better Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Elementor Addons: from n/a through 1.3.7.

  wpdive Better Elementor Addons
  Dec 29, 2025
• Medium 6.4
  CVE-2025-12830

  Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget

  The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider widget in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes …

  wpdive Better Addons for Elementor Web / CMS
  Dec 12, 2025
• Medium 6.4
  CVE-2025-8624

  Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget

  The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This make…

  wpdive Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Web / CMS
  Sep 30, 2025
• Medium 6.5
  CVE-2025-30952

  WordPress Nexa Blocks plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdive Nexa Blocks nexa-blocks allows Stored XSS.This issue affects Nexa Blocks: from n/a through <= 1.1.0.

  wpdive Nexa Blocks
  Jun 6, 2025
• Medium 4.9
  CVE-2025-30976

  WordPress Nexa Blocks plugin <= 1.1.1 - Server Side Request Forgery (SSRF) vulnerability

  Server-Side Request Forgery (SSRF) vulnerability in wpdive Nexa Blocks nexa-blocks allows Server Side Request Forgery.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

  wpdive Nexa Blocks
  Jun 6, 2025
• Medium 6.4
  CVE-2024-2280

  Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links

  The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget link URL values in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. Th…

  wpdive Better Addons for Elementor Web / CMS
  Mar 29, 2024