CVE Intelligence

WP Messiah Frontis Blocks — Block Library for the Block Editor vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting WP Messiah Frontis Blocks — Block Library for the Block Editor: 1 record(s), with affected versions and fixes.

CVE-2026-0807 High · 7.2 CWE-918 Jan 24, 2026
Frontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
The Frontis Blocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.1.6. This is due to insufficient restriction on the 'url' parameter in the 'template_proxy' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application via the '/template-proxy/' and '/proxy-image/' endpoint.