CVE-2024-13635

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The VK Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.94.2.2 via the page content block. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the content of private posts and pages.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Mar 7, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-136376.5The Demo Awesome plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plCVE-2024-136387.5The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includCVE-2024-136394.3The Read More & Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability checkCVE-2024-13645.4The Elementor Website Builder Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget's custom_id in all versions uCVE-2024-136405.9The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up tCVE-2024-136417.5The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPreCVE-2024-136425.4The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hotspot widget in aCVE-2024-136438.8The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modification. This vulneCVE-2024-136445.4The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's De Gallery widget in all verCVE-2024-136459.8The tagDiv Composer plugin for WordPress is vulnerable to PHP Object Instantiation in all versions up to, and including, 5.3 via module paraCVE-2024-136468.1The Single-user-chat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insCVE-2024-136474.3The School Management System – SakolaWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin