PT-2026-26273 · WordPress · Themehunk Gutenberg Blocks

Jarno Vos + 1 · Publicado 2026-03-19 · Atualizado 2026-04-09 · CVE-2026-25438

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ThemeHunk Gutenberg Blocks versions through 1.2.8

Description A flaw exists in ThemeHunk Gutenberg Blocks that allows for Reflected Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could potentially allow an attacker to inject malicious scripts into web pages viewed by users. The affected API endpoints and vulnerable parameters were not specified.

Recommendations Update ThemeHunk Gutenberg Blocks to a version later than 1.2.8.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-25438

Produtos afetados

Themehunk Gutenberg Blocks

Referências · 6

• https://patchstack.com/database/wordpress/plugin/unlimited-blocks/vulnerability/wordpress-gutenberg-blocks-unlimited-blocks-for-gutenberg-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota
• https://twitter.com/CVEnew/status/2036024227976093723 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25438 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2034600947209437357 · Publicação no Twitter
• https://patchstack.com/database/Wordpress/Plugin/unlimited-blocks/vulnerability/wordpress-gutenberg-blocks-unlimited-blocks-for-gutenberg-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota
• https://twitter.com/atomicedgeWAF/status/2042263781644882045 · Publicação no Twitter