PT-2026-47690 · Undefined · Undefined

Luca Jungnickel · Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-8981

Mitre

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW UNFILTERED HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8981

Affected Products

Undefined

References · 2

• 🔥 https://wpscan.com/vulnerability/9815b0e6-e411-4a5c-9c63-30bad21da698 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8981 · Security Note