Custom Query Blocks CVE-2026-108168

Requires an authenticated attacker holding at least a low-privilege account (PR:L, e.g., contributor/author) on a WordPress site running the Custom Query Blocks plugin version 5.6.0 or earlier, able to submit input that the plugin stores and renders without proper neutralization. Exploitation further requires that a separate user (typically an administrator or visitor) subsequently views the page containing the stored payload (UI:R), so the attack is not fully automatable and does not fire on injection alone. Limiting factors: the vulnerability is only present on sites with this specific plugin installed and enabled, requires valid credentials rather than unauthenticated access, and depends on victim interaction, which substantially narrows realistic exploitation to multi-user or open-registration deployments.

This is a moderate-severity stored XSS (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) in the WordPress 'Custom Query Blocks' plugin, reported by Patchstack. The network attack vector and low complexity are offset by two meaningful constraints: PR:L means the attacker must already hold a valid low-privilege authenticated account (e.g., contributor/author) on the target WordPress site, and UI:R means a second user must view the page containing the injected payload for it to fire. The scope change (S:C) reflects that the script executes in a victim's browser session rather than only the vulnerable component, which is why confidentiality, integrity and availability each carry a Low impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied in the input, so there is no signal of active or probable exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' Overall this is a real but second-tier priority: it depends on attacker-held credentials and victim interaction, making it more relevant to multi-author or open-registration WordPress sites than to tightly controlled single-admin installations. No conflicting signals were detected, but the absence of EPSS/KEV/POC means risk is assessed purely from the CVSS vector and description.

An attacker with a low-privilege authenticated account (such as a contributor) on a WordPress site running Custom Query Blocks ≤5.6.0 injects a malicious script into an input field that the plugin fails to properly neutralize during page generation. The payload is stored and later executes in the browser of a higher-privileged user (such as an administrator) who views the affected page, potentially leading to session theft or admin-context actions. No public exploit code was identified at time of analysis.