Unknown Custom Block Builder vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Custom Block Builder, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.1CVE-2024-12878thedevoicelazy_blocks+2
EPSS score
0.62%
The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.4.4CVE-2026-8981unknowncustom block builder+1
EPSS score
0.24%
The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.