WordPress plugin
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 8 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High3
- Medium5
- Low0
All aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.8 | Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute ≤2.17.0Update to 2.18.0 | CVE-2026-110018 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤2.17.0Update to 2.18.0 | CVE-2026-40804 | |
| High8.8 | Authenticated (Contributor+) Privilege Escalation <2.9.1Update to 2.9.1 | CVE-2026-57386 |
- High8.8Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute
≤2.17.0Update to 2.18.0
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.17.0Update to 2.18.0
- High8.8Authenticated (Contributor+) Privilege Escalation
<2.9.1Update to 2.9.1
aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: common questions
Does aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder: 3 high, 5 medium. None are known to affect version null.
How do I check which version of aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder vulnerability?
CVE-2026-118800, published Nov 6, 2026: aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute. Severity: Medium (CVSS 6.4).
Is any aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder vulnerability listed in CISA KEV?
No. None of the known aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder vulnerabilities is currently listed in the CISA KEV catalog.