B Blocks CVE-2026-104400

Exploitation requires the attacker to hold an authenticated WordPress account with sufficient capability to create or edit content using the B Blocks plugin (consistent with PR:L), and the injected stored payload only triggers when another user - typically an administrator or editor - subsequently views the affected block content (UI:R). Limiting factors: the attacker cannot exploit this unauthenticated; a posting-capable role is needed; a privileged victim must visit the page for the changed-scope impact to materialize; and only sites running B Blocks at or below version 2.1.8 are affected. This is not exploitable against a default WordPress install lacking the plugin.

This is a medium-severity (CVSS 6.5) stored cross-site scripting flaw in the bPlugins B Blocks WordPress plugin (through 2.1.8), reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation but requires authentication (PR:L - a low-privilege authenticated user such as a contributor/author) and victim user interaction (UI:R), with a changed scope reflecting that injected script executes in another user's browser context. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation likelihood signals are absent rather than elevated. Exploitation status: no public exploit identified at time of analysis. This profile is a routine, patch-on-cycle WordPress plugin XSS rather than an emergency: the authentication and user-interaction requirements meaningfully constrain real-world risk, and the impact metrics are all 'Low'. The dual requirement of an attacker holding a posting-capable account AND a privileged victim viewing the malicious content is the key limiting factor. Note no EPSS/KEV/POC data was supplied - absence here is not evidence of safety, only of unconfirmed exploitation.

An authenticated low-privilege user (e.g., a contributor) with access to the B Blocks editor injects a malicious script payload into a block field that is not properly sanitized. When an administrator or another user later views the post or page containing the stored payload, the script executes in their browser session, potentially performing actions as that privileged user. No public exploit code was identified in the provided data.