Stored Cross-Site Scripting in Scratchblocks for WP Plugin by WordPress

CVE-2026-6247

What is CVE-2026-6247?

The Scratchblocks for WP plugin is susceptible to Stored Cross-Site Scripting via the 'element' attribute of the 'scratchblocks' shortcode. This vulnerability arises from inadequate input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject malicious scripts into pages. These scripts execute when users access the compromised pages, potentially compromising their data and security.

References