Qi Blocks vulnerabilities

The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in versions up to and including 1.4.9. Missing validation on the 'page_id' parameter allows authenticated attackers with author-level access or higher to modify Qi Blocks styles of arbitrary posts, templates, or widgets they do not own, including site-wide surfaces via reserved 'template' and 'widget' values.

Stored Cross-Site Scripting (XSS) vulnerability in Qi Blocks (versions up to 1.4.3). Allows an attacker to inject a persistent script that executes in the victim's browser.

The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.4.3. The plugin stores arbitrary CSS styles submitted via the `qi-blocks/v1/update-styles` REST API endpoint without proper sanitization in the `update_global_styles_callback()` function. An authenticated attacker with Contributor-level access or higher can inject arbitrary CSS, which can be used to hide content, overlay fake UI elements, or exfiltrate sensitive information via CSS injection techniques.