What is the CVSS score of CVE-2026-3498?

CVE-2026-3498 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3498

EUVD-2026-21617 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-11 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 11, 2026 - 01:30 euvd

EUVD-2026-21617

Analysis Generated

Apr 11, 2026 - 01:30 vuln.today

CVE Published

Apr 11, 2026 - 01:24 nvd

MEDIUM 6.4

DescriptionCVE.org

The BlockArt Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'clientId' block attribute in all versions up to, and including, 2.2.15. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in BlockArt Blocks plugin for WordPress allows authenticated attackers with Author-level or higher permissions to inject arbitrary JavaScript into page content via the 'clientId' block attribute due to insufficient input sanitization and output escaping. An attacker can craft malicious block content that executes in the browsers of all users viewing the compromised page. The vulnerability affects all versions up to and including 2.2.15, with a fix available in version 2.3.0.

Technical ContextAI

The BlockArt Blocks plugin, a WordPress Gutenberg block builder and page template library, fails to properly sanitize and escape the 'clientId' block attribute when rendering block output. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw where user-controlled input is reflected in HTML without adequate escaping. The affected code paths are in the QueryLoop and PostTemplate block type handlers (referenced in tags/2.2.15 source), where the clientId parameter is passed directly into the block rendering pipeline without proper sanitization on input or escaping on output. WordPress blocks using the Gutenberg editor framework should leverage wp_kses_post() or similar functions to sanitize block attributes before storage and esc_html(), esc_attr(), or wp_kses_post() depending on context when outputting block attributes in HTML or JavaScript.

RemediationAI

Update the BlockArt Blocks plugin to version 2.3.0 or later immediately. Site administrators should navigate to the WordPress Plugins dashboard, locate BlockArt Blocks, and click the available update button. For sites unable to update immediately, disable the BlockArt Blocks plugin until the patch can be applied. Verify no malicious block content was added to pages or posts during the vulnerability window by reviewing recent page and post edits, paying particular attention to any changes by users with Author-level access. The fix is available in version 2.3.0 as documented in the WordPress plugins repository changeset (reference: https://plugins.trac.wordpress.org/changeset?old_path=%2Fblockart-blocks/tags/2.2.15&new_path=%2Fblockart-blocks/tags/2.3.0). For additional details, consult the Wordfence vulnerability report.