CVE-2026-15420mediumCWE-22

CVE-2026-15420: falha de média gravidade em posimyththemes Nexter Blocks – Gutenberg…

Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter

Publicada em

Seguir esta CVE+ Monitorar Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.9%
The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plus_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary JS/CSS files on the server, which can lead to denial of service or destruction of critical plugin and theme assets.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
posimyththemes · Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder
CVEs relacionadas — posimyththemes Nexter Blocks – Gutenberg…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-5020MEDIUMMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryEPSS 0.4%CVE-2026-6740MEDIUMNexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block AttributeEPSS 0.3%CVE-2025-8567MEDIUMNexter Blocks <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsEPSS 0.3%