WordPress security by component
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder
Plugin description
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder is a WordPress component with 10 published CVE records in this archive. The latest tracked vulnerability was published Jul 24, 2026; the highest CVE/CNA score is 7.1.
Plugin slug:
the-plus-addons-for-block-editorLatest vulnerability
CVE-2026-15420: Nexter Blocks plus_name traversal lets subscribers delete assets
A subscriber with a valid public tpgb-addons nonce can call the tpda_purge_current_clear AJAX action and place traversal in plus_name. Vulnerable code passes that value into remove_current_page_dir_files(), appends .min.css or .min.js and deletes the resulting path, allowing unintended plugin or theme assets to be removed. The CNA lists 5.0.0 as affected although the current official 5.0.0 package already contains capability and allowlist checks.
| Safe version |
|
||
|---|---|---|---|
| Jul 24, 2026 |
CVE-2026-15420
Nexter Blocks plus_name traversal lets subscribers delete assets
A subscriber with a valid public tpgb-addons nonce can call the tpda_purge_current_clear AJAX action and place traversal in plus_name. Vulnerable code passes that value into remove_current_page_dir_files(), appends .min.css or .min.js and deletes the resulting path, allowing unintended plugin or theme assets to be removed. The CNA lists 5.0.0 as affected although the current official 5.0.0 package already contains capability and allowlist checks.
|
> 5.0.0 |
CVE4.3
NVDPending
|
| Apr 08, 2026 |
CVE-2026-39516
Nexter Blocks: A security weakness
Nexter Blocks is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.7.0.
|
4.7.1 |
CVE5.3
NVDPending
|
| Feb 20, 2026 |
CVE-2024-50452
Nexter Blocks: Cross-site scripting
Nexter Blocks is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Jan 22, 2026 |
CVE-2026-24377
Nexter Blocks: A security weakness
Nexter Blocks is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Aug 19, 2025 |
CVE-2025-8567
Nexter Blocks: Cross-site scripting
Nexter Blocks is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Aug 14, 2025 |
CVE-2025-54739
Nexter Blocks: A security weakness
Nexter Blocks is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Jan 07, 2025 |
CVE-2024-56294
Nexter Blocks: A security weakness
Nexter Blocks is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.4
NVDPending
|
| Jan 02, 2025 |
CVE-2024-56246
Nexter Blocks: Cross-site scripting
Nexter Blocks is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Jun 09, 2024 |
CVE-2024-33572
Nexter Blocks: A security weakness
Nexter Blocks is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVD8.8
|
| Mar 29, 2024 |
CVE-2024-30435
Nexter Blocks: Cross-site scripting
Nexter Blocks is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE7.1
NVDPending
|