Stored Cross-Site Scripting Vulnerability in WPMK Block Plugin for WordPress

CVE-2026-4125

What is CVE-2026-4125?

The WPMK Block plugin for WordPress contains a Stored Cross-Site Scripting vulnerability, allowing authenticated users with Contributor-level access or higher to inject malicious scripts via the 'class' attribute in shortcodes. Due to a lack of proper input sanitization and output escaping in the wpmk_block_shortcode() function, user-controlled inputs can be directly included in the HTML output without sufficient validation. This presents a significant risk, as the injected scripts can execute in the context of a user's session, potentially compromising sensitive information and site security.

References