Site Building with Toolset vulnerabilities

Products

• Toolset Blocks 1
• Toolset Forms 1

Latest Site Building with Toolset CVEs

Newest publication first

1. CVE-2026-78264 WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability

   Published 2026-08-24

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.

2. CVE-2026-56069 WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-06-26

   High·CVSS 7.5 EPSS 0.43%

   Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.