aBlocks – WordPress Gutenberg Blocks
aBlocks – WordPress Gutenberg Blocks adds Gutenberg blocks for creating structured layouts and content elements in WordPress.
aBlocks – WordPress Gutenberg Blocks (ablocks) is a WordPress plugin with 6 published CVE records in this archive. The latest tracked vulnerability was published Oct 24, 2026; the highest published CVSS base score is 8.8.
ablocksCVE-2026-110018: aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: Contributor-to-Editor privilege escalation
aBlocks through 2.17.0 lets a Contributor or higher save a block in their own post with formType set to login and an attacker-chosen roleSlug, bypassing the registration-only save-time check in RegistrationFormSanitizer::verify(). The /ablocks/v1/form-builder/registration REST route has a permissive permission callback; register() reads roleSlug from post_content without checking at runtime that formType is registration. A valid wp_rest nonce and post ownership are still required. WP_User::set_role() and wp_set_auth_cookie() then grant the elevated role and an authenticated session. is_safe_registration_role() rejects roles with administrator-tier capabilities, so the disclosed escalation reaches Editor or another permitted non-Administrator role, not Administrator on standard WordPress.
| Safe version |
|
||
|---|---|---|---|
| Oct 24, 2026 |
CVE-2026-110018
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: Contributor-to-Editor privilege escalation
aBlocks through 2.17.0 lets a Contributor or higher save a block in their own post with formType set to login and an attacker-chosen roleSlug, bypassing the registration-only save-time check in RegistrationFormSanitizer::verify(). The /ablocks/v1/form-builder/registration REST route has a permissive permission callback; register() reads roleSlug from post_content without checking at runtime that formType is registration. A valid wp_rest nonce and post ownership are still required. WP_User::set_role() and wp_set_auth_cookie() then grant the elevated role and an authenticated session. is_safe_registration_role() rejects roles with administrator-tier capabilities, so the disclosed escalation reaches Editor or another permitted non-Administrator role, not Administrator on standard WordPress.
|
See mitigation notes |
CVE8.8
|
| Oct 08, 2026 |
CVE-2026-40804
aBlocks: Unauthenticated reflected cross-site scripting
An attacker without an account can supply input that is reflected into browser output without sufficient neutralization. Script can execute under the site's origin when a victim interacts with the crafted request or response. The supplied vector requires victim interaction and reports limited confidentiality, integrity and availability impact. The export does not identify the endpoint, parameter, rendering function, output context or victim role. Affected versions: <= 2.16.0. No fixed release is confirmed. The checked official release remains 2.16.0; its stored-XSS changelog entries do not establish remediation for this reflected-XSS record.
|
See mitigation notes |
CVE7.1
|
| Jul 13, 2026 |
CVE-2026-57386
aBlocks: Privilege escalation or authentication bypass
aBlocks is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 2.9.1.
|
2.9.1 |
CVE8.8
|
| Jan 07, 2026 |
CVE-2025-12449
aBlocks – WordPress Gutenberg Blocks: A security weakness
aBlocks – WordPress Gutenberg Blocks is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.4
|
| May 07, 2025 |
CVE-2025-47616
aBlocks: Cross-site scripting
aBlocks is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
|
| Feb 18, 2025 |
CVE-2024-13465
aBlocks – WordPress Gutenberg Blocks: Cross-site scripting
aBlocks – WordPress Gutenberg Blocks is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
|