Custom Query Blocks

Custom Query Blocks has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 4 are fixed as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (75%). Other recurring categories include Missing Authorization.

Every one of the 4 issues recorded for Custom Query Blocks has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. Custom Query Blocks is installed on roughly 700 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Custom Query Blocks vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-108168

Custom Query Blocks <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

4 records


2026-10-12 08:22	Custom Query Blocks <= 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Custom Query Blocks <= 5.6.0	`CVE-2026-108168`	6.4 Medium	V1T	Yes
2026-02-12 00:00	Custom Query Blocks <= 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Custom Query Blocks <= 5.5.0	`CVE-2026-39575`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes
2024-08-29 00:00	Custom Query Blocks <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Custom Query Blocks <= 5.3.1	`CVE-2024-44059`	6.4 Medium	João G. Barbosa (4rCanJ0x!)	Yes
2024-07-22 00:00	Custom Query Blocks <= 5.2.0 - Missing Authorization via REST Routes Custom Query Blocks <= 5.2.0	`CVE-2024-38794`	5.3 Medium	Joshua Chan	Yes

Showing 1–4 of 4 reports

Latestv5.7.0

Custom Query Blocks

Author

Ronald Huereca

4.6(25)

92/100

Last Updated

2026-10-09 (19d ago)

Active Installs

700+

Downloads

36,838

Requires WP

6.5+

Requires PHP

7.2+

Tested up to

WP 7.1.3

Created

2018-09-30 (8y ago)

A WordPress plugin for displaying posts and terms (e.g., categories) using a Gutenberg block. Works well with posts, pages, custom post types, taxonomies, and terms. Bonus Plugin Up for Adoption Custom Query Blocks will be im maintenance mode after October 1, 2026. Please find a replacement. Successor Archive Pages Pro has been archived and released. Map your post type archives to a page for customization of the post type archive page. Map your category archives to a page for customization of the term archive page. Map your 404 template to a page and easily customize your 404 page. Post Type Archive Mapping This plugin allows you to map your custom post type archive pages. Just create a page and go to Settings->Reading to set the page for your archive. Ensure your post types have has_archive set to true. Select a Public page to use as your post type archive page. View the archive and you will see the page content instead of the archive content. Use page templates on your pages for flexibility. Custom Gutenberg block for showing your posts. Term Archive Mapping This plugin also allows you to map your term archives to a page. Just create a page and go edit your term to set the archive page. Create a public page to use as your term archive. Visit the edit term page and select the page. View the term and you will see your selected page. Use Gutenberg on your public page to customize the archive. 404 Page Mapping This plugin allows you to map a page to your 404 template, so you can customize a 404 page as needed. Development is on GitHub Development is on GitHub Archive Pages Pro Archive Pages Pro was the pro version of this plugin, but has been archived and released.

View on WordPress.org