4.3 Medium

CVE-2026-1228 The Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin for WordPress…

Description

The Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.3 via the tlgb_shortcode() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to disclose private timeline content via the id attribute supplied to the 'timeline_block' shortcode.

Affected products and versions

Product	Affected versions	Fixed in
Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) 1.3	earliest → 1.3.3	No fix stated

Do you use Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines)?

Track this CVE Watch Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) Check my SBOMs

www.cveye.io/en/cve/CVE-2026-1228

Timeline

Published February 6, 2026
Last modified April 8, 2026

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org

Track this CVE