The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| The Plus Addons For Block Editor Plugin | — | Update the-plus-addons-for-block-editor plugin to version 5.0.2, or a newer patched version | Aug 17, 2026 | Aug 3, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub