WordPress plugin
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 8 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High3
- Medium5
- Low0
All aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder vulnerabilities
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute
≤2.18.0Update to 2.20.0
- Medium4.3Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode
≤2.18.0Update to 2.20.0
- High8.8Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute
≤2.17.0Update to 2.18.0
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.17.0Update to 2.18.0
- High8.8Authenticated (Contributor+) Privilege Escalation
<2.9.1Update to 2.9.1
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Settings Modification
≤2.4.0Update to 2.5.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.9.2Update to 1.9.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.6.1Update to 1.6.2
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: common questions
Does aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: 3 high, 5 medium. None are known to affect version null.
How do I check which version of aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder vulnerability?
CVE-2026-118800, published Nov 6, 2026: aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute. Severity: Medium (CVSS 6.4).
Is any aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder vulnerability listed in CISA KEV?
No. None of the known aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder vulnerabilities is currently listed in the CISA KEV catalog.