Executive brief
The Magazine Blocks plugin, used by WordPress site administrators to create news and content blocks, contains a security flaw in its News Ticker feature that allows attackers to inject malicious scripts. An authenticated attacker with contributor access or higher can craft specially crafted content that executes in the browsers of anyone viewing affected pages, potentially leading to account compromise or data theft.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the NewsTicker::render() method of the Magazine Blocks plugin. The vulnerable code concatenates the clientId block attribute directly into an HTML class attribute without applying proper output escaping (specifically esc_attr()). Exploitation requires authentication as a contributor or higher-privileged user, allowing an attacker to inject arbitrary JavaScript that persists in page content. When other users (including administrators) visit the compromised page, the malicious script executes in their browser context. The vulnerability affects versions up to and including 1.8.6; patches are expected to be available in later releases.
Affected products
- Magazine Blocks Magazine Blocks up to 1.8.6
Timeline
- 2026-09-18: disclosed