PatchTheCVE: vanderwijkhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-6432: The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via https://patchthecve.com/cve/CVE-2024-6432.htmlhttps://patchthecve.com/cve/CVE-2024-6432.htmlWed, 17 Jun 2026 08:18:00 +0000MEDIUM 6.4: The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter within the plugin's shortcode Content Block in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possCVE-2024-44051: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan vahttps://patchthecve.com/cve/CVE-2024-44051.htmlhttps://patchthecve.com/cve/CVE-2024-44051.htmlWed, 17 Jun 2026 07:52:13 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) custom-post-widget allows Stored XSS.This issue affects Content Blocks (Custom Post Widget): from n/a through <= 3.3.5.CVE-2024-3565: The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via https://patchthecve.com/cve/CVE-2024-3565.htmlhttps://patchthecve.com/cve/CVE-2024-3565.htmlWed, 17 Jun 2026 07:44:31 +0000MEDIUM 6.4: The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_block' shortcode in all versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possiCVE-2024-3564: The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all vershttps://patchthecve.com/cve/CVE-2024-3564.htmlhttps://patchthecve.com/cve/CVE-2024-3564.htmlWed, 17 Jun 2026 07:44:31 +0000HIGH 8.8: The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the plugin's 'content_block' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execuCVE-2024-34566: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan vahttps://patchthecve.com/cve/CVE-2024-34566.htmlhttps://patchthecve.com/cve/CVE-2024-34566.htmlWed, 17 Jun 2026 07:33:38 +0000MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) allows Stored XSS.This issue affects Content Blocks (Custom Post Widget): from n/a through 3.3.0.