Slingblocks Vulnerabilities

The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block's attributes in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This m...

CVSS:

6.4

Affected:

up to 1.6.0

Fixed in:

1.7.0

Disclosed:

Aug 20, 2025

CVE-2025-8607 on NVD →

The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "Icon List" Block in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVSS:

6.4

Affected:

up to 1.5.0

Fixed in:

1.6.0

Disclosed:

Mar 7, 2025

CVE-2024-13675 on NVD →

The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access an...

CVSS:

6.4

Affected:

up to 1.4.1

Fixed in:

1.5.0

Disclosed:

Jul 10, 2024

CVE-2024-38684 on NVD →