CVE-2026-1228

Name of the Vulnerable Software and Affected Versions The Timeline Block – Beautiful Timeline Builder for WordPress versions up to and including 1.3.3

Description The software is susceptible to an Insecure Direct Object Reference issue. This is due to a lack of validation on a user-controlled key within the tlgb shortcode() function. Authenticated attackers with Author-level access or higher can potentially disclose private timeline content by manipulating the id attribute within the 'timeline block' shortcode.

Recommendations Update The Timeline Block – Beautiful Timeline Builder for WordPress to a version later than 1.3.3.