Cross Site Scripting Vulnerability in Premium Blocks Plugin for WordPress
CVE-2026-94118

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Premium Blocks – Gutenberg Blocks For WordPress
Vendor
CVE Published:
23 September 2026

What is CVE-2026-94118?

The Premium Blocks plugin for WordPress is susceptible to a Cross Site Scripting (XSS) vulnerability. This flaw affects versions 2.3.17 and earlier, allowing attackers to inject malicious scripts through user input fields. If exploited, this vulnerability can compromise the security of web applications using the plugin, potentially leading to unauthorized access or data exposure. It is crucial for website administrators to update to secure versions and implement necessary security measures to mitigate risks associated with XSS attacks.

Affected Version(s)

Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17

References

https://patchstack.com/database/wordpress/plugin/premium-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

benzdeus | Patchstack Bug Bounty Program
.