Executive brief
The All Bootstrap Blocks WordPress plugin, used by site administrators to create styled content blocks, contains a cross-site scripting (XSS) vulnerability in how it handles user-supplied block attributes. A contributor or higher-privileged user can inject malicious scripts into page content that execute in the browsers of visitors viewing that content, potentially allowing account compromise or data theft.
Technical details
The vulnerability is a stored XSS flaw (CWE-79) in the plugin's handling of the "type" attribute in the areoi/button block. The plugin fails to properly escape the block attribute before outputting it directly into an HTML tag-name position, allowing injection of arbitrary JavaScript. An attacker with Contributor-level access or above can craft malicious block markup that persists in the site content; when that content is viewed, the injected script executes in the browser context of any visitor, including administrators. No known patch is currently available.
Affected products
- WordPress All Bootstrap Blocks through 1.3.31
Timeline
- 2026-09-16: disclosed
- 2026-09-18: advisory: Published to NVD