Qi Blocks

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Qi Blocks

Information

Software Type Plugin
Software Slug qi-blocks (view on wordpress.org)
Software Status Active
Software Author qodeinteractive
Software Website qodeinteractive.com
Software Downloads 893,253
Software Active Installs 60,000
Software Record Last Updated July 17, 2026

10 Vulnerabilities

Submit a Vulnerability
Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter
4.3
CVE-2026-10096
Jun 30, 2026
Researcher: Dmitrii Ignatyev
Qi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize
4.3
CVE-2025-12182
Nov 14, 2025
Researcher: Adrian Lukita
Qi Blocks <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update
4.3
CVE-2025-12180
Oct 31, 2025
Researcher: Adrian Lukita
Qi Blocks <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-64383
Aug 11, 2025
Researcher: Denver Jackson
Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ToC Block
5.4
CVE-2025-1627
Apr 28, 2025
Researcher: Krugov Artyom
Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Block
5.4
CVE-2025-1626
Apr 28, 2025
Researcher: Krugov Artyom
Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Counter Block
5.4
CVE-2025-1625
Apr 28, 2025
Researcher: Krugov Artyom
Qi Blocks <= 1.3.2 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2024-49690
Oct 21, 2024
Researcher: João Pedro Soares de Alcântara
Qi Blocks <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2024-38712
Jul 11, 2024
Researcher: João Pedro Soares de Alcântara
Qi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2024-5221
Jun 5, 2024
Researcher: wesley (wcraft)
Title Status CVE ID CVSS Researchers Date
Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter Patched CVE-2026-10096 4.3 Dmitrii Ignatyev June 30, 2026
Qi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize Patched CVE-2025-12182 4.3 Adrian Lukita November 14, 2025
Qi Blocks <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update Patched CVE-2025-12180 4.3 Adrian Lukita October 31, 2025
Qi Blocks <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-64383 6.4 Denver Jackson August 11, 2025
Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ToC Block Patched CVE-2025-1627 5.4 Krugov Artyom April 28, 2025
Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Block Patched CVE-2025-1626 5.4 Krugov Artyom April 28, 2025
Qi Blocks <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Counter Block Patched CVE-2025-1625 5.4 Krugov Artyom April 28, 2025
Qi Blocks <= 1.3.2 - Authenticated (Contributor+) Local File Inclusion Patched CVE-2024-49690 8.8 João Pedro Soares de Alcântara October 21, 2024
Qi Blocks <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2024-38712 6.4 João Pedro Soares de Alcântara July 11, 2024
Qi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting Patched CVE-2024-5221 6.4 wesley (wcraft) June 5, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation