Responsive Block Control – Hide blocks based on display width

Responsive Block Control – Hide blocks based on display width has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Responsive Block Control – Hide blocks based on display width has a vendor fix available, so running the current release closes it.

All of these findings were reported by Peter Thaleikis. Responsive Block Control – Hide blocks based on display width is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Responsive Block Control – Hide blocks based on display width vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-62135

Responsive Block Control <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Responsive Block Control – Hide blocks based on display width banner
Latestv1.3.2

Responsive Block Control – Hide blocks based on display width

landwire

Author

landwire

5.0(4)
100/100
Last Updated
2026-02-21 (7mo ago)
Active Installs
1,000+
Downloads
15,716
Requires WP
5.2+
Requires PHP
7.4+
Tested up to
WP 6.9.7
Created
2020-01-30 (7y ago)

Responsive Block Control adds responsive toggles to a “Visibility” panel of the block editor, to show or hide blocks according to screen width. Security Version 1.3.1 resolves a stored cross‑site scripting (XSS) vulnerability (CVE‑2025‑62135) affecting earlier versions (<= 1.2.9). Users with contributor access or higher should update immediately. If you discover a security vulnerability, please report it responsibly to: security@saschapaukner.de Limitations Does not work with the Classic Block, Widget Block or Widget Area Block [&#8216;core/freeform’, &#8216;core/legacy-widget’, &#8216;core/widget-area’], as the those blocks do not support block attributes. Does also not work with the HTML Block [&#8216;core/html’] inside the Widget Screen, as this one also does not support block attributes there. Configuration Override existing breakpoints function override_responsive_block_control_breakpoints($break_points) { $break_points['base'] = 0; $break_points['mobile'] = 400; $break_points['tablet'] = 800; $break_points['desktop'] = 1000; $break_points['wide'] = 1600; return $break_points; } add_filter('responsive_block_control_breakpoints', 'override_responsive_block_control_breakpoints'); Provide custom CSS You can provide your own CSS rules per breakpoint using the new filter responsive_block_control_custom_css_rules. add_filter('responsive_block_control_custom_css_rules', function($rules) { return [ 'mobile' => 'display: none !important;', 'tablet' => 'display: none !important;', 'desktop' => 'display: none !important;', 'wide' => 'display: none !important;', ]; }); Stop css output completely function override_responsive_block_control_add_css() { return false; } add_filter('responsive_block_control_breakpoints', 'override_responsive_block_control_add_css');

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C