WordPress plugin
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 9 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium9
- Low0
All Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint ≤1.8.6Update to 1.8.7 | CVE-2026-75017 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute ≤1.8.6Update to 1.8.7 | CVE-2026-75016 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.8.6Update to 1.8.7 | CVE-2026-78290 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.8.3Update to 1.8.4 | CVE-2026-57650 | |
| Medium4.3 | Missing Authorization ≤1.8.3Update to 1.8.4 | CVE-2026-40728 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.3.20Update to 1.3.21 | CVE-2024-56258 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤1.3.15Update to 1.3.18 | CVE-2024-50429 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤1.3.14Update to 1.3.15 | CVE-2024-9218 | |
| Medium6.4 | Authenticated (Author+) Stored Cross-Site Scripting ≤1.3.6Update to 1.3.7 | CVE-2024-34760 |
- Medium4.3Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint
≤1.8.6Update to 1.8.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute
≤1.8.6Update to 1.8.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.8.6Update to 1.8.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.8.3Update to 1.8.4
- Medium4.3Missing Authorization
≤1.8.3Update to 1.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.3.20Update to 1.3.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.3.15Update to 1.3.18
- Medium6.1Reflected Cross-Site Scripting
≤1.3.14Update to 1.3.15
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤1.3.6Update to 1.3.7
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid: common questions
Does Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid: 9 medium. None are known to affect version null.
How do I check which version of Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid vulnerability?
CVE-2026-75017, published Sep 17, 2026: Magazine Blocks <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint. Severity: Medium (CVSS 4.3).
Is any Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid vulnerability listed in CISA KEV?
No. None of the known Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid vulnerabilities is currently listed in the CISA KEV catalog.