Stored Cross-Site Scripting Vulnerability in Stackable Page Builder Gutenberg Blocks Plugin for WordPress

CVE-2026-9601

What is CVE-2026-9601?

The Stackable – Page Builder Gutenberg Blocks plugin for WordPress contains a vulnerability that allows an authenticated attacker with contributor-level access and above to exploit the 'update_block_style' endpoint. Due to inadequate input sanitization and output escaping, attackers can inject malicious web scripts into pages, which subsequently execute when users access the compromised pages. This vulnerability poses significant security risks to websites using the affected versions of this plugin, necessitating immediate action to mitigate potential exploits.

References