EUVD-2026-42841
GHSA-cfxv-7hcj-vfr5
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Administrator authentication (PR:H) and non-default unfiltered_html restriction (AC:H) are both mandatory; scope change captures cross-user XSS impact on other browsers.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Highlighting Code Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
Stored Cross-Site Scripting in the Highlighting Code Block WordPress plugin (versions ≤ 2.2.0) allows authenticated attackers holding administrator-level permissions to inject persistent malicious scripts via the plugin's admin settings panel, with those scripts executing in the browsers of any user who subsequently visits an affected page. Exploitation is constrained to WordPress multi-site network installations or single-site deployments where the unfiltered_html capability has been explicitly disabled - conditions that are non-default and substantially narrow the attacker population. No public exploit code or active exploitation has been identified at time of analysis; Wordfence, the reporting source, has published a fix commit to the plugin's SVN repository, though a specific patched release version is not yet confirmed.
Technical ContextAI
The vulnerability is a Stored Cross-Site Scripting flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the Highlighting Code Block plugin developed by looswebstudio (CPE: cpe:2.3:a:looswebstudio:highlighting_code_block:*:*:*:*:*:*:*:*). Source code references pinpoint the defective logic across three class files: loos_hcb.php (line 158), loos_hcb_menu.php (line 23), and loos_hcb_scripts.php (line 69), indicating that multiple admin-facing input fields fail both to sanitize values on input and to escape them on output. In standard WordPress single-site deployments, administrators inherently possess the unfiltered_html capability, which already permits raw HTML and script injection through core interfaces - making this plugin-level sanitization gap moot in that context. The flaw becomes exploitable only where that capability is revoked, specifically on multi-site networks (where site-level admins may lack super-admin privileges) or hardened single-site installs using the DISALLOW_UNFILTERED_HTML constant or equivalent security hardening.
RemediationAI
The primary remediation is to update the Highlighting Code Block plugin to a version beyond 2.2.0 once a patched release is published to the WordPress plugin directory. A fix commit is available in the plugin's SVN repository at https://plugins.trac.wordpress.org/changeset?reponame=&old=3592103%40highlighting-code-block&new=3592103%40highlighting-code-block, but a specific tagged patched release version has not been independently confirmed from available data - verify the current version in the WordPress plugin repository before updating. As a compensating control, administrators should audit which accounts hold administrator-level privileges and reduce that set to the minimum necessary, since the attack requires administrator authentication. On multi-site networks, restrict site-admin capabilities using WordPress's native capability management rather than relying on plugin-level filtering. If the Highlighting Code Block plugin is not actively in use, deactivating and removing it eliminates the attack surface entirely with no functional trade-off. Additionally, deploying a web application firewall with XSS filtering rules (such as Wordfence's own firewall ruleset) can block injection attempts as a defense-in-depth measure, though this should not substitute for patching.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today