WordPress security by component
Attire Blocks
Plugin description
Attire Blocks is a WordPress component with 3 published CVE records in this archive. The latest tracked vulnerability was published Jan 24, 2025; the highest published CVSS base score is 6.4.
Plugin slug:
attire-blocksLatest vulnerability
CVE-2025-24696: Attire Blocks: Cross-site request forgery
Attire Blocks is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
| Safe version |
|
||
|---|---|---|---|
| Jan 24, 2025 |
CVE-2025-24696
Attire Blocks: Cross-site request forgery
Attire Blocks is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Dec 12, 2024 |
CVE-2024-11914
Gutenberg Blocks and Page Layouts – Attire Blocks: Cross-site scripting
Gutenberg Blocks and Page Layouts – Attire Blocks is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Jun 05, 2024 |
CVE-2024-4088
Gutenberg Blocks and Page Layouts – Attire Blocks: Cross-site request forgery
Gutenberg Blocks and Page Layouts – Attire Blocks is affected by cross-site request forgery. Exploitation requires an authenticated subscriber account. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE4.3
NVD4.3
|