Category Posts Block
Category Posts Block has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 3 are fixed as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10. 2024 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (100%).
Every one of the 3 issues recorded for Category Posts Block has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Dmitrii Ignatyev. Category Posts Block is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-1453Category Posts Widget <= 4.9.19 - Authenticated (Admin+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Category Posts Block
Author
ZephyrWest
Category Posts Block is a light block designed to do one thing and do it well: display the most recent posts from a certain category. Category Posts Block Use the “Category Posts” block in the Gutenberg editor to place the post list anywhere in your content. All options are available in the block sidebar panels: Title, Filter, Details, Thumbnail, Excerpt, Footer, Load more and General. Several blocks can be used on the same page, each with its own settings. Term and Category based Posts Block A premium version of that free block available at tiptoppress.com created for big WordPress sites. Premium features Auto-sizing Grid layout Custom field support in the Template Shortcode support in the Template Image-Slider (or News-Ticker) Asymmetrical list layouts Full background images Masonry responsive grid layout More complex filter (ANY, NOT, AND, …) Custom Post Types, Events, Products support All free features E-Mail support More examples on the demo pages Features Block for the block editor and Site Editor. Template to arrange the post details. The Template text can be a post details placeholder, plain text, HTML or a font-icons. Font-icon support ‘Load more’ button / Ajax API Item Title heading level buttons Excerpt length and item title in lines (line-clamp) Date range filter New date format: Time since plublished Filter by post status: Published, scheduled, private Add option for post offset (use two or more widgets after another) Admin UI: Buttons in the editor toolbar to insert shortcode Option to touch device friendly “everything is a link” Set thumbnail width & height / image crop with CSS (object-fit) Fluid images (max-width in %) One thumb dimension can be left empty Option to set mouse hover effects for post thumbnail Set a default thumbnail Hide widget text or text, if there is no post Option to hide posts which have no thumbnail Option exclude current post Option show post author, comment’s count, post date Admin UI: Set / find thumbnail size buttons: +, ¼, ½, 2x, -, ratio and Media sizes Admin UI: Buttons to easy add post details placeholder Documentation Full documentation Formatting date and time: See Formatting Date and Time Contribute While using this plugin if you find any bug or any conflict, please submit an issue at Github (If possible with a pull request).
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C