Security Alert Summary
The Content Blocks (Custom Post Widget) plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the content_block shortcode. Insufficient input sanitization and output escaping in user-created content blocks allow authenticated users with contributor-level access and above to inject scripts that execute when an injected page is viewed.
CVE Details
- CVE ID:
CVE-2026-0894 - Affected component: Content Blocks (Custom Post Widget) plugin for WordPress (the plugin’s
content_blockshortcode) - Affected versions: All versions up to, and including, 3.3.9
- Published: April 18, 2026 at 10:16:12 AM UTC
- Last modified: April 18, 2026 at 10:16:12 AM UTC
- CVSS v3.1: Base Score 6.4, Severity MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: LOW (authenticated, contributor-level and above)
- User Interaction: NONE
- Scope: CHANGED
- Vector:
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting)
Technical Details
According to the advisory, the vulnerability is a stored cross-site scripting issue rooted in insufficient input sanitization and output escaping for values provided by users inside plugin-managed content blocks. The plugin consumes user-created content via its content_block shortcode; values from those blocks are not properly sanitized or escaped before being rendered on pages. As a result, an authenticated attacker with contributor-level access or higher can store arbitrary web scripts in a content block. Those scripts will execute in the context of any page that renders the injected block when other users visit that page.
The weakness is in how user-supplied content is handled during storage and output; no additional functions, REST endpoints, or code paths are named beyond the shortcode in the provided data. The impact is limited to client-side script execution in pages that include the injected content block.
How This Could Impact Your Website
In a typical WordPress site with multiple users, a contributor or higher could create or edit a content block that contains malicious script. When staff members or site visitors view a page containing that block, the script can run in their browsers. Practical consequences include the exposure of internal user information visible to the browser, or actions performed on behalf of those users in their browser sessions. This increases the risk of targeted phishing or social-engineering campaigns using information harvested from affected pages.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and higher.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, such as unexpected content edits or new content blocks.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
