Responsive Block Control – Hide blocks based on display width
Responsive Block Control – Hide blocks based on display width has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Responsive Block Control – Hide blocks based on display width has a vendor fix available, so running the current release closes it.
All of these findings were reported by Peter Thaleikis. Responsive Block Control – Hide blocks based on display width is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-62135Responsive Block Control <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Responsive Block Control – Hide blocks based on display width
Author
landwire
Responsive Block Control adds responsive toggles to a “Visibility” panel of the block editor, to show or hide blocks according to screen width. Security Version 1.3.1 resolves a stored cross‑site scripting (XSS) vulnerability (CVE‑2025‑62135) affecting earlier versions (<= 1.2.9). Users with contributor access or higher should update immediately. If you discover a security vulnerability, please report it responsibly to: security@saschapaukner.de Limitations Does not work with the Classic Block, Widget Block or Widget Area Block [‘core/freeform’, ‘core/legacy-widget’, ‘core/widget-area’], as the those blocks do not support block attributes. Does also not work with the HTML Block [‘core/html’] inside the Widget Screen, as this one also does not support block attributes there. Configuration Override existing breakpoints function override_responsive_block_control_breakpoints($break_points) { $break_points['base'] = 0; $break_points['mobile'] = 400; $break_points['tablet'] = 800; $break_points['desktop'] = 1000; $break_points['wide'] = 1600; return $break_points; } add_filter('responsive_block_control_breakpoints', 'override_responsive_block_control_breakpoints'); Provide custom CSS You can provide your own CSS rules per breakpoint using the new filter responsive_block_control_custom_css_rules. add_filter('responsive_block_control_custom_css_rules', function($rules) { return [ 'mobile' => 'display: none !important;', 'tablet' => 'display: none !important;', 'desktop' => 'display: none !important;', 'wide' => 'display: none !important;', ]; }); Stop css output completely function override_responsive_block_control_add_css() { return false; } add_filter('responsive_block_control_breakpoints', 'override_responsive_block_control_add_css');
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C