Button Block CVE-2026-116400

Requires an authenticated WordPress user with at least low-privilege content-authoring rights (e.g. contributor/author) who can insert a Button Block, matching PR:L in the vector. The stored payload only triggers when another user - typically an administrator or editor - subsequently views the content containing the malicious block, matching UI:R. Exploitation is therefore limited to deployments running Button Block ≤1.2.7 that provision lower-trust authenticated accounts; single-admin sites with no untrusted authors face substantially reduced real-world exposure. The precise sanitization gap and exact block field are not detailed in the available sources beyond the CWE-79 classification.

This is a moderate-severity Stored XSS (CWE-79) with a provider CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The network attack vector and low complexity are offset by two real constraints encoded in the vector: PR:L means the attacker must already hold an authenticated, low-privilege WordPress account (typically a contributor/author who can place blocks), and UI:R means a victim - usually an administrator or another user - must view the page containing the stored payload for the script to fire. The scope change (S:C) reflects script executing in the victim's authenticated browser session, which is why confidentiality, integrity and availability each show limited (L) impact rather than none. No EPSS score, SSVC automatable/technical-impact values, or KEV entry were provided in the input, so probabilistic exploitation likelihood cannot be quantified here. There is no KEV listing and no confirmed public exploit code - the only reference is the Patchstack advisory itself. The vuln.today decision label is 'this_month', not act_now or emergency, consistent with a credentialed stored-XSS issue rather than a mass-exploitable unauthenticated flaw. Net: a legitimate issue to patch on a normal (this-month) cadence, not a drop-everything emergency, with real risk concentrated in multi-author sites where lower-trust accounts exist.

A multi-author WordPress site runs the Button Block plugin (≤1.2.7) and grants contributor/author accounts to lower-trust users. An authenticated low-privilege user crafts a Button Block with a malicious script payload in an improperly sanitized field; when an administrator or another user later views that content in wp-admin or on the front end, the script executes in their session. No public exploit code is confirmed in the provided data - only the Patchstack advisory is referenced.