Smart Blocks Vulnerabilities

The Smart Blocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.4

Fixed in:

2.5

Disclosed:

Sep 22, 2025

CVE-2025-59561 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HashThemes Smart Blocks allows Stored XSS.This issue affects Smart Blocks: from n/a through 2.0.

Affected:

up to 2.1

Fixed in:

2.1

Disclosed:

Oct 16, 2024

CVE-2024-49270 on NVD →

The Smart Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that...

CVSS:

6.4

Affected:

up to 2.0

Fixed in:

2.1

Disclosed:

Oct 14, 2024

CVE-2024-49270 on NVD →

Affected:

up to 2.5

Fixed in:

2.5

CVE-2025-59561 on NVD →