Search
Find a vulnerability
Search criteria
6 vulnerabilities by extendify
CVE-2026-85679 (GCVE-0-2026-85679)
Vulnerability from nvd – Published: 2026-10-01 05:30 – Updated: 2026-10-01 05:30
VLAI
EPSS
VEX
Title
Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
Summary
The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because registerIncoming() is hooked on rest_request_before_callbacks and runs before WordPress evaluates the route's permission_callback, meaning any unauthenticated POST, PUT, or PATCH request to a /wp/v2/global-styles route can trigger the vulnerable code path.
Severity
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Extendify",
"vendor": "extendify",
"versions": [
{
"lessThanOrEqual": "3.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jack Taylor"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027styles.blocks\u0027 Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because registerIncoming() is hooked on rest_request_before_callbacks and runs before WordPress evaluates the route\u0027s permission_callback, meaning any unauthenticated POST, PUT, or PATCH request to a /wp/v2/global-styles route can trigger the vulnerable code path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T05:30:55.047Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38024680-2d99-4af0-b805-6fd718a1d338?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L62"
},
{
"url": "https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L75"
},
{
"url": "https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L29"
},
{
"url": "https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L37"
},
{
"url": "https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/bootstrap.php#L112"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3688833%40extendify%2Ftags%2F3.2.0\u0026old=3669317%40extendify%2Ftags%2F3.1.6"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3688833/extendify/trunk/app/Shared/Services/BlockStyleVariations.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-04T18:29:02.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-30T16:46:01.000Z",
"value": "Disclosed"
}
],
"title": "Extendify \u003c= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via \u0027styles.blocks\u0027 Block Type Key"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-85679",
"datePublished": "2026-10-01T05:30:55.047Z",
"dateReserved": "2026-09-04T13:38:58.902Z",
"dateUpdated": "2026-10-01T05:30:55.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-6635 (GCVE-0-2023-6635)
Vulnerability from nvd – Published: 2024-02-05 21:21 – Updated: 2026-04-08 16:49
VLAI
EPSS
VEX
Title
EditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload
Summary
The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' function in versions up to, and including, 1.40.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-08 15:46 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| munirkamal | Gutenberg Block Editor Toolkit – EditorsKit |
Affected:
0 , ≤ 1.40.3
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:35:14.917Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4528f9a1-7027-4aa9-b006-bea84aa19c84?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/browser/block-options/tags/1.40.3/includes/addons/styles-manager/rest-api/gutenberghub-styles-import-export-controller.php#L100"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset/3010794/block-options"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-08T15:46:08.003490Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-15T19:46:29.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gutenberg Block Editor Toolkit \u2013 EditorsKit",
"vendor": "munirkamal",
"versions": [
{
"lessThanOrEqual": "1.40.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Istv\u00e1n M\u00e1rton"
}
],
"descriptions": [
{
"lang": "en",
"value": "The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the \u0027import_styles\u0027 function in versions up to, and including, 1.40.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:49:31.407Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4528f9a1-7027-4aa9-b006-bea84aa19c84?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/block-options/tags/1.40.3/includes/addons/styles-manager/rest-api/gutenberghub-styles-import-export-controller.php#L100"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3010794/block-options"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-12-08T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2023-12-08T00:00:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2023-12-16T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "EditorsKit \u003c= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2023-6635",
"datePublished": "2024-02-05T21:21:42.520Z",
"dateReserved": "2023-12-08T19:39:29.662Z",
"dateUpdated": "2026-04-08T16:49:31.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-24546 (GCVE-0-2021-24546)
Vulnerability from nvd – Published: 2021-10-11 10:45 – Updated: 2024-08-03 19:35
VLAI
EPSS
VEX
Title
EditorsKit < 1.31.6 - Contributor+ Arbitrary PHP Code Execution
Summary
The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code
Severity
No CVSS data available.
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/bdc36f6a-682d-4d… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Gutenberg Block Editor Toolkit – EditorsKit |
Affected:
1.31.6 , < 1.31.6
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:35:20.035Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Gutenberg Block Editor Toolkit \u2013 EditorsKit",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.31.6",
"status": "affected",
"version": "1.31.6",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "bl4derunner"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gutenberg Block Editor Toolkit \u2013 EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-11T10:45:28.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "EditorsKit \u003c 1.31.6 - Contributor+ Arbitrary PHP Code Execution",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24546",
"STATE": "PUBLIC",
"TITLE": "EditorsKit \u003c 1.31.6 - Contributor+ Arbitrary PHP Code Execution"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Gutenberg Block Editor Toolkit \u2013 EditorsKit",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.31.6",
"version_value": "1.31.6"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "bl4derunner"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Gutenberg Block Editor Toolkit \u2013 EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24546",
"datePublished": "2021-10-11T10:45:29.000Z",
"dateReserved": "2021-01-14T00:00:00.000Z",
"dateUpdated": "2024-08-03T19:35:20.035Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-85679 (GCVE-0-2026-85679)
Vulnerability from cvelistv5 – Published: 2026-10-01 05:30 – Updated: 2026-10-01 05:30
VLAI
EPSS
VEX
Title
Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
Summary
The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because registerIncoming() is hooked on rest_request_before_callbacks and runs before WordPress evaluates the route's permission_callback, meaning any unauthenticated POST, PUT, or PATCH request to a /wp/v2/global-styles route can trigger the vulnerable code path.
Severity
7.2 (High)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Extendify",
"vendor": "extendify",
"versions": [
{
"lessThanOrEqual": "3.1.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jack Taylor"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027styles.blocks\u0027 Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because registerIncoming() is hooked on rest_request_before_callbacks and runs before WordPress evaluates the route\u0027s permission_callback, meaning any unauthenticated POST, PUT, or PATCH request to a /wp/v2/global-styles route can trigger the vulnerable code path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T05:30:55.047Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38024680-2d99-4af0-b805-6fd718a1d338?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L62"
},
{
"url": "https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L75"
},
{
"url": "https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L29"
},
{
"url": "https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L37"
},
{
"url": "https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/bootstrap.php#L112"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3688833%40extendify%2Ftags%2F3.2.0\u0026old=3669317%40extendify%2Ftags%2F3.1.6"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3688833/extendify/trunk/app/Shared/Services/BlockStyleVariations.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-04T18:29:02.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-30T16:46:01.000Z",
"value": "Disclosed"
}
],
"title": "Extendify \u003c= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via \u0027styles.blocks\u0027 Block Type Key"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-85679",
"datePublished": "2026-10-01T05:30:55.047Z",
"dateReserved": "2026-09-04T13:38:58.902Z",
"dateUpdated": "2026-10-01T05:30:55.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-6635 (GCVE-0-2023-6635)
Vulnerability from cvelistv5 – Published: 2024-02-05 21:21 – Updated: 2026-04-08 16:49
VLAI
EPSS
VEX
Title
EditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload
Summary
The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' function in versions up to, and including, 1.40.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-08 15:46 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| munirkamal | Gutenberg Block Editor Toolkit – EditorsKit |
Affected:
0 , ≤ 1.40.3
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:35:14.917Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4528f9a1-7027-4aa9-b006-bea84aa19c84?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/browser/block-options/tags/1.40.3/includes/addons/styles-manager/rest-api/gutenberghub-styles-import-export-controller.php#L100"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset/3010794/block-options"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-08T15:46:08.003490Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-15T19:46:29.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Gutenberg Block Editor Toolkit \u2013 EditorsKit",
"vendor": "munirkamal",
"versions": [
{
"lessThanOrEqual": "1.40.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Istv\u00e1n M\u00e1rton"
}
],
"descriptions": [
{
"lang": "en",
"value": "The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the \u0027import_styles\u0027 function in versions up to, and including, 1.40.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site\u0027s server which may make remote code execution possible."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:49:31.407Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4528f9a1-7027-4aa9-b006-bea84aa19c84?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/block-options/tags/1.40.3/includes/addons/styles-manager/rest-api/gutenberghub-styles-import-export-controller.php#L100"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3010794/block-options"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-12-08T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2023-12-08T00:00:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2023-12-16T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "EditorsKit \u003c= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2023-6635",
"datePublished": "2024-02-05T21:21:42.520Z",
"dateReserved": "2023-12-08T19:39:29.662Z",
"dateUpdated": "2026-04-08T16:49:31.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-24546 (GCVE-0-2021-24546)
Vulnerability from cvelistv5 – Published: 2021-10-11 10:45 – Updated: 2024-08-03 19:35
VLAI
EPSS
VEX
Title
EditorsKit < 1.31.6 - Contributor+ Arbitrary PHP Code Execution
Summary
The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code
Severity
No CVSS data available.
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/bdc36f6a-682d-4d… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Unknown | Gutenberg Block Editor Toolkit – EditorsKit |
Affected:
1.31.6 , < 1.31.6
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:35:20.035Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Gutenberg Block Editor Toolkit \u2013 EditorsKit",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.31.6",
"status": "affected",
"version": "1.31.6",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "bl4derunner"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Gutenberg Block Editor Toolkit \u2013 EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-11T10:45:28.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "EditorsKit \u003c 1.31.6 - Contributor+ Arbitrary PHP Code Execution",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24546",
"STATE": "PUBLIC",
"TITLE": "EditorsKit \u003c 1.31.6 - Contributor+ Arbitrary PHP Code Execution"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Gutenberg Block Editor Toolkit \u2013 EditorsKit",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.31.6",
"version_value": "1.31.6"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "bl4derunner"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Gutenberg Block Editor Toolkit \u2013 EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/bdc36f6a-682d-4d66-b587-92e86085d971"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24546",
"datePublished": "2021-10-11T10:45:29.000Z",
"dateReserved": "2021-01-14T00:00:00.000Z",
"dateUpdated": "2024-08-03T19:35:20.035Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}