CVE-2026-8981

3.5 Faible

Publiée le 09/06/2026 à 08:16 · Modifiée le 23/07/2026 à 10:10 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.

Traduire en français

Produits concernés

Unknown Custom Block Builder

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.5 Faible	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://wpscan.com/vulnerability/9815b0e6-e411-4a5c-9c63-30bad21da698/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories