Security Alert Summary
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some values submitted via its Form block before including them in the HTML notification email sent to the site owner. This allows unauthenticated users to inject arbitrary HTML, such as phishing links, into those notification emails.
CVE Details
- CVE ID: CVE-2026-97315
- Affected product: Responsive Blocks (WordPress plugin)
- Affected versions: Versions before 2.3.0
- Published: October 14, 2026 at 11:17:09 AM
- Last modified: October 14, 2026 at 4:14:02 PM
- CVSS v3.1: Base score 5.4 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Authentication / privileges / user interaction: No privileges required (PR:N); unauthenticated network attacker (AV:N); user interaction required (UI:R)
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE / weakness: CWE-74 (Improper Neutralization of Special Elements in Output)
Technical Details
The plugin’s Form block accepts submitted values and inserts some of those values into the HTML notification email sent to the site owner without proper sanitisation or escaping. Because these input values are included in an HTML email, an unauthenticated attacker can inject arbitrary HTML elements or links into the notification message.
The issue exists where form-submitted values are added to the notification email output without the necessary output encoding or sanitisation steps. The CVE description does not name specific functions or REST endpoints involved, so only the general lack of escaping in notification email generation is reported.
The immediate impact is limited to the content of the notification email: injected HTML can present phishing links or other deceptive content to the email recipient. The vulnerability does not, based on the provided data, indicate remote code execution or direct modification of the site content or database.
How This Could Impact Your Website
In a typical site setup, a contractor or external contributor could submit a Form block entry that includes malicious HTML. The site owner and internal staff who receive the plugin’s notification emails could then see emails containing attacker-controlled links or HTML. This increases the risk that staff or contractors might click phishing links or otherwise be targeted using content that appears to come from their own site.
For example, an external contributor could submit a form that injects a link into the HTML notification email. The site owner or an editor who receives that email could be exposed to a phishing link, and internal email addresses or contact information included in notifications could be used to craft targeted social engineering attempts.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level access.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site and email notification activity for unusual behavior or unexpected links.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
