Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · qi-blocks
Qi Blocks
10 known vulnerabilities on record. Add your version above to see which ones affect you.
Jul 1, 2026Qi Blocks: Insecure Direct Object ReferenceCVE-2026-10096 · affects up to 1.4.9 · reported by WordfenceMedium 4.3
The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'page_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify the stored Qi Blocks styles of arbitrary posts, templates, or widgets they do not own — including site-wide surfaces via the reserved 'template' and 'widget' page_id values — enabling unauthorized frontend defacement, content hiding, and degradation of any page on the site. The endpoint's permission_callback checks only the generic edit_posts and publish_posts capabilities, meaning any user with the built-in Author role satisfies the check regardless of post ownership.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 14, 2025Qi Blocks: Unauthorized accessCVE-2025-12182 · affects up to 1.4.3 · reported by WordfenceMedium 4.3
The Qi Blocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the `resize_image_callback()` function in all versions up to, and including, 1.4.3. This is due to the plugin not properly verifying that a user has permission to resize a specific attachment. This makes it possible for authenticated attackers, with Contributor-level access and above, to resize arbitrary media library images belonging to other users, which can result in unintended file writes, disk consumption, and server resource abuse through processing of large images.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 13, 2025Qi Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64383 · affects up to 1.4.3 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks allows Stored XSS.This issue affects Qi Blocks: from n/a through <= 1.4.3.
Nov 1, 2025Qi Blocks: Missing AuthorizationCVE-2025-12180 · affects up to 1.4.3 · reported by WordfenceMedium 4.3
The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.3. This is due to the plugin storing arbitrary CSS styles submitted via the `qi-blocks/v1/update-styles` REST API endpoint without proper sanitization in the `update_global_styles_callback()` function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary CSS, which can be used to perform actions such as hiding content, overlaying fake UI elements, or exfiltrating sensitive information via CSS injection techniques.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2025Qi Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2025-1627 · fixed in 1.4 · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
May 19, 2025Qi Blocks: Does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embedCVE-2025-1626 · fixed in 1.4 · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
May 19, 2025Qi Blocks: Does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embedCVE-2025-1625 · fixed in 1.4 · reported by WPScanMedium 5.4
The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Oct 23, 2024Qi Blocks: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-49690 · affects up to 1.3.2 · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Qode Qi Blocks qi-blocks.This issue affects Qi Blocks: from n/a through <= 1.3.2.
Jul 20, 2024Qi Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-38712 · affects up to 1.3 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks.This issue affects Qi Blocks: from n/a through <= 1.3.
Jun 6, 2024Qi Blocks: Stored Cross-Site ScriptingCVE-2024-5221 · affects up to 1.2.9 · reported by WordfenceMedium 6.4
The Qi Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file uploader in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.