PT-2026-51694 · 24Liveblog · 24Liveblog – Live Blog Tool

Joy Gilbert · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-9183

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The 24liveblog - live blog tool plugin for WordPress is vulnerable to Exposure of Sensitive Information in versions up to, and including, 2.2. This is due to the lb24 block enqueue scripts() function being hooked to enqueue block editor assets and, for any non-administrator user, falling back to loading the administrator-configured site-wide 24liveblog integration secrets (lb24 token, lb24 refresh token, lb24 uid, lb24 uname) from the options table via get option() and emitting them through wp localize script() as the lb24BlockData JavaScript object. This makes it possible for authenticated attackers, with contributor-level access and above, to extract third-party 24liveblog account credentials (including the API token and refresh token) by simply opening the block editor and inspecting the page source.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-9183

Affected Products

24Liveblog – Live Blog Tool

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-9183 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ceaccdb3-4d98-4463-9db9-a6f1712d6869?source=cve · Note
• https://plugins.trac.wordpress.org/browser/24liveblog/trunk/src/init.php#L157 · Note
• https://plugins.trac.wordpress.org/browser/24liveblog/trunk/src/init.php#L139 · Note