Cross-Site Scripting Flaw in DLX Plugins Custom Query Blocks
CVE-2026-108168

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Custom Query Blocks
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108168?

A Cross-Site Scripting (XSS) vulnerability exists in DLX Plugins Custom Query Blocks, specifically in the post-type-archive-mapping feature. This flaw allows attackers to inject malicious scripts into web pages, which may be executed in the context of other users. The vulnerability affects versions of Custom Query Blocks up to 5.6.0, enabling stored XSS attacks that could compromise user data and site integrity. Users are urged to apply the necessary updates to safeguard their websites.

Affected Version(s)

Custom Query Blocks 0 <= 5.6.0

References

https://patchstack.com/database/wordpress/plugin/post-typ...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

V1T | Patchstack Bug Bounty Program
.