Attire Blocks Vulnerabilities

The Attire Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can tri...

CVSS:

4.3

Affected:

up to 1.9.6

Fixed in:

1.9.7

Disclosed:

Jan 24, 2025

CVE-2025-24696 on NVD →

The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attire-blocks/post-carousel' block in all versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVSS:

6.4

Affected:

up to 1.9.5

Fixed in:

1.9.6

Disclosed:

Dec 11, 2024

CVE-2024-11914 on NVD →

The Gutenberg Blocks and Page Layouts – Attire Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable_fe_assets function in all versions up to, and including, 1.9.2. This makes it possible for authenticated attackers, with subscriber access or abo...

CVSS:

4.3

Affected:

up to 1.9.2

Fixed in:

1.9.3

Disclosed:

Jun 4, 2024

CVE-2024-4088 on NVD →