Executive brief
The scratchblocks for WP plugin, which allows WordPress users to display Scratch-style code blocks, contains a security flaw that allows certain users to inject malicious scripts into website pages. An attacker with contributor-level access or higher can use this vulnerability to run unauthorized code in the browsers of other visitors. This could lead to unauthorized actions being performed on behalf of site administrators or the theft of sensitive session information.
Technical details
The scratchblocks for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'element' attribute within the 'scratchblocks' shortcode. This vulnerability exists in all versions up to and including 1.0.1. An authenticated attacker with contributor-level permissions or higher can inject arbitrary web scripts into the 'element' attribute. These scripts are then stored on the server and executed in the context of any user's browser who views the affected page. The attack vector is network-based and requires low administrative privileges, but no user interaction from the victim beyond visiting the compromised page.
Affected products
- WordPress scratchblocks for WP up to, and including, 1.0.1
Timeline
- 2026-05-12: advisory: Advisory published by Wordfence and NVD