Executive brief
Magazine Blocks is a WordPress plugin that provides content formatting and layout blocks for site builders. The plugin contains a cross-site scripting (XSS) vulnerability that allows contributors with plugin editing privileges to inject malicious scripts. If exploited, an attacker could compromise visitor accounts or steal sensitive data from users browsing affected sites.
Technical details
Magazine Blocks <= 1.8.6 contains a stored cross-site scripting (XSS) vulnerability in the plugin code. The vulnerability is classified as an OWASP A3 injection flaw. Exploitation requires a user with Contributor or higher privilege on the WordPress site to inject malicious JavaScript code via plugin inputs. User interaction is required—a victim must click a crafted link or visit a page containing the injected payload. Successful exploitation allows attackers to execute arbitrary JavaScript in the context of visitor browsers, enabling session hijacking, credential theft, or malware injection. The vulnerability was patched in version 1.8.7.
Affected products
- ThemeGrill Magazine Blocks <=1.8.6
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Version 1.8.7 released