Modern Design Library
Modern Design Library has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Modern Design Library has a vendor fix available, so running the current release closes it.
All of these findings were reported by Peter Thaleikis. Modern Design Library is installed on roughly 70 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-5842Modern Design Library <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
Read the full analysisVulnerability Records

Modern Design Library
Author
Ciprian Popescu
Modern Design Library is a toolkit of opinionated Gutenberg blocks for WordPress. All optional blocks are registered using PHP-only block registration (autoRegister) — no JavaScript build step or Node.js tooling required. The plugin ships with: Colored Line — a fully customisable horizontal separator block with striped, shade, and dotted style variants (classic JS-registered block). Advanced Separator (experimental) — a PHP-only separator with configurable width, height, padding, alignment, and three decorative variants. Advanced Heading (experimental) — 13 decorative heading styles, heading level selector (H1–H6), optional tagline, and full typography/spacing/border block support controls. Accent decorations automatically follow the text colour. Marquee (experimental) — a single infinitely scrolling text row. Stack multiple blocks for multi-row layouts. Speed (Slow/Medium/Fast) and direction (Left/Right) are configurable. Animation script is loaded lazily — only on pages containing the block. Call to Action (experimental) — a CTA banner with heading, subheading, button label/URL, three visual variants (Primary/Secondary/Dark), and native colour overrides. Author Box (experimental) — displays a user card with avatar, bio, email, and LinkedIn link. User is selected from a dropdown. LinkedIn URL is stored as user meta (set on the user’s profile page). Optional blocks are enabled from Settings → Modern Design Library → Modules. The optional blocks require the Gutenberg plugin or WordPress 7.0+ for the autoRegister block support. Read more on getButterfly. Explore more WordPress Plugins. For a deep dive into how the PHP-only blocks work, read PHP-Only Block Registration in WordPress 7.0.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C