PT-2026-26273 · WordPress · Themehunk Gutenberg Blocks

Jarno Vos + 1 · Published 2026-03-19 · Updated 2026-04-09 · CVE-2026-25438

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ThemeHunk Gutenberg Blocks versions through 1.2.8

Description A flaw exists in ThemeHunk Gutenberg Blocks that allows for Reflected Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability could potentially allow an attacker to inject malicious scripts into web pages viewed by users. The affected API endpoints and vulnerable parameters were not specified.

Recommendations Update ThemeHunk Gutenberg Blocks to a version later than 1.2.8.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25438

Affected Products

Themehunk Gutenberg Blocks

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-25438 · Security Note
• https://patchstack.com/database/wordpress/plugin/unlimited-blocks/vulnerability/wordpress-gutenberg-blocks-unlimited-blocks-for-gutenberg-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2036024227976093723 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034600947209437357 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/unlimited-blocks/vulnerability/wordpress-gutenberg-blocks-unlimited-blocks-for-gutenberg-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/atomicedgeWAF/status/2042263781644882045 · Twitter Post