Simple Blog Card

Simple Blog Card has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 5.7, and the most serious one scores 6.4 out of 10. 2023 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 1 of the records (33%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Server-Side Request Forgery (SSRF).

Every one of the 3 issues recorded for Simple Blog Card has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Simple Blog Card is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.7/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Simple Blog Card vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-32357

Simple Blog Card <= 2.37 - Authenticated (Contributor+) Server-Side Request Forgery

Read the full analysis

Vulnerability Records

3 records
Plugin Profile
Latestv2.38

Simple Blog Card

Katsushi Kawamori

Author

Katsushi Kawamori

5.0(3)
100/100
Last Updated
2026-08-16 (28d ago)
Active Installs
3,000+
Downloads
46,536
Requires WP
6.6+
Requires PHP
8.0+
Tested up to
WP 7.1
Created
2019-11-12 (7y ago)

Blog card Generated with shortcode Generated with block Can specify the number of characters displayed in the description. Displays an ogp image. Can specify the size of the displayed ogp image. Can change the title and description. Warning A redirect loop occurs when all three of the following factors are met: * When two sites with different domains embed “Simple Blog Card” for each other on their top pages. * When two sites with different domains are on the same server (same IP address). * When the ”Simple Blog Card” caches of two sites on different domains are empty. How it works Customize Template files allow for flexible customization. The default template file is template/simpleblogcard-template.php. Using this as a reference, you can specify a separate template file using the filters below. /** ================================================== * Filter for template file. * */ add_filter( 'simple_blog_card_generate_template_file', function () { $wp_uploads = wp_upload_dir(); $upload_dir = wp_normalize_path( $wp_uploads['basedir'] ); $upload_dir = untrailingslashit( $upload_dir ); return $upload_dir . '/tmp/simpleblogcard-template.php'; }, 10, 1 ); CSS files can be set separately. Please see the filters below. /** ================================================== * Filter for CSS file. * */ add_filter( 'simple_blog_card_css_url', function () { $wp_uploads = wp_upload_dir(); $upload_url = $wp_uploads['baseurl']; if ( is_ssl() ) { $upload_url = str_replace( 'http:', 'https:', $upload_url ); } $upload_url = untrailingslashit( $upload_url ); return $upload_url . '/tmp/simpleblogcard.css'; }, 10, 1 );

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C