Hyperlink Group Block Vulnerabilities

The Hyperlink Group Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tiptip/hyperlink-group-block' block in versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

CVSS:

6.4

Affected:

up to 2.0.1

Fixed in:

2.0.2

Disclosed:

Apr 1, 2025

CVE-2025-31885 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Floeter Hyperlink Group Block allows DOM-Based XSS. This issue affects Hyperlink Group Block: from n/a through 2.0.1.

Affected:

up to 2.0.1

Fix:

No patched version reported

Disclosed:

Apr 1, 2025

CVE-2025-31885 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TipTopPress Hyperlink Group Block allows Stored XSS.This issue affects Hyperlink Group Block: from n/a through 1.17.5.

Affected:

up to 1.17.6

Fixed in:

1.17.6

Disclosed:

Oct 17, 2024

CVE-2024-49279 on NVD →

The Hyperlink Group Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.17.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in...

CVSS:

6.4

Affected:

up to 1.17.5

Fixed in:

1.17.6

Disclosed:

Oct 15, 2024

CVE-2024-49279 on NVD →