Icon List Block Vulnerabilities

The Icon List Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 1.2.3

Fixed in:

1.2.4

Disclosed:

Feb 15, 2026

CVE-2026-32359 on NVD →

The Icon List Block – Add Icon-Based Lists with Custom Styles plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.1 via the fs_api_request function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to...

CVSS:

6.4

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

Nov 18, 2025

CVE-2025-12376 on NVD →

[en] The Icon List Block – Add Icon-Based Lists with Custom Styles plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.1 via the fs_api_request function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web reques...

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Nov 18, 2025

CVE-2025-12376 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block allows Stored XSS. This issue affects Icon List Block: from n/a through 1.1.3.

Affected:

up to 1.1.4

Fixed in:

1.1.4

Disclosed:

Feb 25, 2025

CVE-2025-26937 on NVD →

The Icon List Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 1.1.3

Fixed in:

1.1.4

Disclosed:

Feb 23, 2025

CVE-2025-26937 on NVD →