Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder

Software Type	Plugin
Software Slug	the-plus-addons-for-block-editor (view on wordpress.org)
Software Status	Active
Software Author	posimyththemes
Software Website	nexterwp.com
Software Downloads	463,793
Software Active Installs	10,000
Software Record Last Updated	July 15, 2026

11 Vulnerabilities

Submit a Vulnerability

Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute

6.4

CVE-2026-6740

Jul 7, 2026

Researcher: Muhammad Yudha - DJ

Nexter Blocks <= 4.7.0 - Unauthenticated Information Exposure

5.3

CVE-2026-39516

Mar 26, 2026

Researcher: Bao - BlueRock

Nexter Blocks <= 4.6.3 - Authenticated (Subscriber+) Information Exposure

4.3

CVE-2026-24377

Jan 26, 2026

Researcher: Nabil Irawan

Nexter Blocks <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

6.4

CVE-2025-8567

Aug 18, 2025

Researcher: zer0gh0st

Nexter Blocks <= 4.5.4 - Missing Authorization

5.3

CVE-2025-54739

Aug 14, 2025

Researcher: MD ISMAIL

Nexter Blocks <= 4.0.7 - Missing Authorization

4.3

CVE-2024-56294

Jan 3, 2025

Researcher: Khalid Yusuf

Nexter Blocks <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-56246

Dec 30, 2024

Researcher: João Pedro Soares de Alcântara

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library

6.4

CVE-2024-5020

Dec 3, 2024

Researcher: Webbernaut

Nexter Blocks <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2024-50452

Oct 24, 2024

Researcher: João Pedro Soares de Alcântara

The Plus Blocks for Block Editor | Gutenberg <= 3.2.5 - Missing Authorization

4.3

CVE-2024-33572

Apr 25, 2024

Researcher: LVT-tholv2k

The Plus Blocks for Block Editor | Gutenberg <= 3.2.5 - Reflected Cross-Site Scripting

6.1

CVE-2024-30435

Mar 28, 2024

Researcher: LVT-tholv2k

Title	Status	CVE ID	CVSS	Researchers	Date
Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute	Patched	CVE-2026-6740	6.4	Muhammad Yudha - DJ	July 7, 2026
Nexter Blocks <= 4.7.0 - Unauthenticated Information Exposure	Patched	CVE-2026-39516	5.3	Bao - BlueRock	March 26, 2026
Nexter Blocks <= 4.6.3 - Authenticated (Subscriber+) Information Exposure	Patched	CVE-2026-24377	4.3	Nabil Irawan	January 26, 2026
Nexter Blocks <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	Patched	CVE-2025-8567	6.4	zer0gh0st	August 18, 2025
Nexter Blocks <= 4.5.4 - Missing Authorization	Patched	CVE-2025-54739	5.3	MD ISMAIL	August 14, 2025
Nexter Blocks <= 4.0.7 - Missing Authorization	Patched	CVE-2024-56294	4.3	Khalid Yusuf	January 3, 2025
Nexter Blocks <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-56246	6.4	João Pedro Soares de Alcântara	December 30, 2024
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library	Patched	CVE-2024-5020	6.4	Webbernaut	December 3, 2024
Nexter Blocks <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2024-50452	6.4	João Pedro Soares de Alcântara	October 24, 2024
The Plus Blocks for Block Editor \| Gutenberg <= 3.2.5 - Missing Authorization	Patched	CVE-2024-33572	4.3	LVT-tholv2k	April 25, 2024
The Plus Blocks for Block Editor \| Gutenberg <= 3.2.5 - Reflected Cross-Site Scripting	Patched	CVE-2024-30435	6.1	LVT-tholv2k	March 28, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation