EUVD-2026-23650Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Page Builder Gutenberg Blocks - CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via external iCal feed data in all versions up to, and including, 3.1.16 due to insufficient output escaping of event titles, descriptions, and locations fetched from external iCal feeds in the Events block rendering function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in CoBlocks Page Builder plugin for WordPress allows authenticated Contributor-level users to inject malicious scripts via external iCal feed data in the Events block, executing arbitrary JavaScript in pages visited by any user. The vulnerability exists in all versions through 3.1.16 due to insufficient output escaping of event titles, descriptions, and locations. CVSS 6.4 reflects limited direct impact (confidentiality and integrity) but broad scope across WordPress installations, and no public exploit code or active exploitation has been confirmed at this time.
Technical ContextAI
The CoBlocks Events block (src/blocks/events/index.php) integrates external iCal calendar feeds into WordPress pages. When rendering event data fetched from remote calendars, the plugin fails to properly escape HTML/JavaScript context in three fields: event titles (line 218), descriptions (line 245-246), and locations (line 255). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation) - the plugin retrieves untrusted data from external iCal sources and outputs it directly into the DOM without WordPress escaping functions like esc_html() or wp_kses_post(). An attacker with Contributor-level or higher WordPress role can craft a malicious iCal feed URL, configure the Events block to fetch from that feed, and embed arbitrary JavaScript in event metadata. When the block renders on any page, the unescaped payload executes in the browsers of all page visitors.
RemediationAI
Update CoBlocks to version 3.1.17 or later, which adds proper output escaping to event titles, descriptions, and locations in the Events block rendering function (verified via plugins.trac.wordpress.org changeset comparing 3.1.16 and 3.1.17 tags). The patch applies WordPress standard escaping functions to the vulnerable output points at lines 218, 245-246, and 255 in src/blocks/events/index.php. If immediate patching is not possible, disable the Events block across all pages and posts until an upgrade is available, or restrict Contributor-level role access to only trusted editorial staff through role management plugins such as Members or User Role Editor. Additionally, audit all existing pages using the Events block with external iCal feeds to identify any injected malicious content and remove compromised feeds or blocks. Monitor iCal feed sources for signs of tampering (unexpected script tags, unusual event content) and consider using Content Security Policy (CSP) headers with restricted script-src directives to mitigate stored XSS impact, though CSP is not a substitute for patching. The disabling workaround reduces functionality and requires manual page editing; patching is the strongly preferred path.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today