bPlugins B Blocks vulnerabilities

Latest bPlugins B Blocks CVEs

Newest publication first

1. CVE-2026-125451 WordPress B Blocks plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerability

   Published 2026-11-11

   Medium·CVSS 6.5 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.15.

2. CVE-2026-104400 WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-05

   Medium·CVSS 6.5 EPSS 0.16%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.

3. CVE-2026-39579 WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability

   Published 2026-06-15

   High·CVSS 8.8 EPSS 0.28%

   Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.

4. CVE-2026-32489 WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerability

   Published 2026-03-25

   Medium·CVSS 6.5 EPSS 0.25%

   Missing Authorization vulnerability in bPlugins B Blocks b-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Blocks: from n/a through < 2.0.30.

5. CVE-2025-54708 WordPress B Blocks Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability

   Published 2025-08-14

   Medium·CVSS 6.5 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows DOM-Based XSS.This issue affects B Blocks: from n/a through <= 2.0.5.

6. CVE-2025-32173 WordPress B Blocks plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability

   Published 2025-04-04

   Medium·CVSS 6.5 EPSS 0.41%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through <= 2.0.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.