lqd vulnerabilities

Products

• LIQUID SPEECH BALLOON 3
• LIQUID BLOCKS 1

Latest lqd CVEs

Newest publication first

1. CVE-2026-65527 WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

   Published 2026-07-23

   Medium·CVSS 6.5 EPSS 0.22%

   Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.

2. CVE-2024-52357 WordPress LIQUID BLOCKS plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

   Published 2024-11-11

   Medium·CVSS 5.4 EPSS 0.26%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lqd LIQUID BLOCKS liquid-blocks allows Stored XSS.This issue affects LIQUID BLOCKS: from n/a through <= 1.2.0.

3. CVE-2023-27889 LIQUID SPEECH BALLOON <= 1.1.8 - Cross-Site Request Forgery to Settings Update

   Published 2023-05-10

   High·CVSS 8.8 EPSS 0.46%

   Cross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of a user and to perform unintended operations by having a user view a malicious page.

4. CVE-2019-17070 LIQUID SPEECH BALLOON < 1.0.7 - Cross-Site Scripting

   Published 2019-10-10

   Medium·CVSS 6.1 EPSS 0.94%

   The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.