WordPress plugin
Content Blocks (Custom Post Widget) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 6 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High1
- Medium5
- Low0
All Content Blocks (Custom Post Widget) vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode ≤3.3.9Update to 3.4.1 | CVE-2026-0894 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter ≤3.3.5Update to 3.3.6 | CVE-2024-6432 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.3.5Update to 3.3.6 | CVE-2024-44051 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via content_block Shortcode ≤3.3.0Update to 3.3.1 | CVE-2024-3565 | |
| High8.8 | Authenticated (Contributor+) Local File Inclusion via Shortcode ≤3.3.0Update to 3.3.1 | CVE-2024-3564 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.3.0Update to 3.3.1 | CVE-2024-34566 |
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode
≤3.3.9Update to 3.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter
≤3.3.5Update to 3.3.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.3.5Update to 3.3.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via content_block Shortcode
≤3.3.0Update to 3.3.1
- High8.8Authenticated (Contributor+) Local File Inclusion via Shortcode
≤3.3.0Update to 3.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.3.0Update to 3.3.1
Content Blocks (Custom Post Widget): common questions
Does Content Blocks (Custom Post Widget) have known vulnerabilities?
Yes. VulnCrest Radar lists 6 known vulnerabilities in Content Blocks (Custom Post Widget): 1 high, 5 medium. None are known to affect version null.
How do I check which version of Content Blocks (Custom Post Widget) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Content Blocks (Custom Post Widget) vulnerability?
CVE-2026-0894, published Apr 17, 2026: Content Blocks (Custom Post Widget) <= 3.3.9 - Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode. Severity: Medium (CVSS 6.4).
Is any Content Blocks (Custom Post Widget) vulnerability listed in CISA KEV?
No. None of the known Content Blocks (Custom Post Widget) vulnerabilities is currently listed in the CISA KEV catalog.