Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks, CVE-2024-11080
- CVE, Research URL
- Home page URL
- Application
- Published on
- Sep 05, 2026
- Research Description
- The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function.
- Affected versions
-
max 2.3.33.
- Status
-
vulnerable