The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass. Authenticated attackers with contributor-level access can demote administrator-owned published builder templates and replace them with attacker-authored block content, potentially leading to defacement, phishing, and SEO spam. This [truncated]
The Magazine Blocks plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the News Ticker block's clientId attribute in versions up to 1.8.6. Authenticated attackers with contributor-level access can inject web scripts that execute when users access injected pages. This vulnerability allows for potential malicious script execution, impacting the security of WordPress installations using [truncated]
