Blocks – Reusable Content, Shortcodes & Site Variables
Blocks – Reusable Content, Shortcodes & Site Variables has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Blocks – Reusable Content, Shortcodes & Site Variables has a vendor fix available, so running the current release closes it.
All of these findings were reported by Rio Darmawan. Blocks – Reusable Content, Shortcodes & Site Variables is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2023-44262Blocks <= 1.6.42 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Blocks – Reusable Content, Shortcodes & Site Variables
Author
Renzo Johnson
Blocks creates reusable content blocks, global content shortcodes, and site variables for WordPress. Create content once, insert it with a shortcode in pages, posts, widgets, or page builders, and update every placement by editing the source block. Use site variables for values such as a phone number, support email, address, price, site title, or current year. Update the variable once as a token like {{blocks:phone}} and every enabled placement displays the new value. Blocks also supports import and export for moving reusable content and variables between sites as a single JSON file. Blocks is focused on reusable site-wide content, not on providing another decorative Gutenberg block collection. Because a block renders through a plain shortcode, the same content follows you across theme changes and builder migrations. Full documentation, examples, and release notes live in the Blocks guide. Reusable Content Blocks and Global Shortcodes Create reusable content once: manage a source block and display it in multiple locations. Insert content with a shortcode: use a shortcode such as [block id="42"] in posts, pages, widgets, templates, and builders. Update every placement: edit the source block instead of changing repeated content one page at a time. Define site variables: reuse values such as phone numbers, email addresses, prices, and the current year. Built-in tokens for your site info: {{blocks:phone}}, {{blocks:email}}, {{blocks:address}}, {{blocks:year}}, {{blocks:site_title}}, and more; the blocks: prefix means tokens never collide with other plugins. Resolve variables everywhere (optional): tokens also work typed directly into regular content, widgets, and page-builder text. Work across editors and builders: ships integrations for Gutenberg, Elementor, Divi, Bricks, Beaver Builder, WPBakery, Oxygen, Breakdance, Zion, Thrive, and Fusion (Avada). Import and export: move blocks and variables between sites using a single JSON file. Organize reusable content: use categories and tags for larger content libraries. Blocks is one of our free WordPress plugins. Browse the full plugin collection.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C