EUVD-2026-96464
GHSA-6v8q-6x3r-wmf4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify unpatched Team Section Block <= 2.0.4
-
DeliveryDeliver crafted XSS payload via vulnerable input/link
-
ExploitVictim loads page or clicks link (UI:R)
-
ExecutionScript executes in victim browser context (S:C)
-
ImpactSteal session or perform admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a victim view the page or interact with attacker-controlled content (CVSS UI:R) served by a WordPress site running the Team Section Block plugin version 2.0.4 or earlier, where the plugin fails to sanitize/encode user-supplied input rendered into the page. No authentication is required of the attacker (PR:N), but the mandatory user-interaction step is the principal limiting factor - the payload only fires when a user (ideally a privileged admin) loads the malicious content. The sparse Patchstack description does not name the exact injectable parameter or whether injection is reflected or stored, so the precise delivery vector should be verified against the vendor/Patchstack advisory. |
| Impact | This is a moderate-severity, unauthenticated reflected/stored Cross-Site Scripting flaw (CWE-79) in the Team Section Block WordPress plugin for versions <= 2.0.4, reported by Patchstack. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) indicates a network-reachable, low-complexity bug requiring no attacker privileges but DOES require victim user interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in a victim's browser context rather than the vulnerable component itself. Real-world risk is tempered by several signals: no EPSS score was provided in the input, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept is referenced - only the Patchstack advisory. The S:C/C:L/I:L/A:L impact scoring is typical of Patchstack's XSS methodology, but the A:L (low availability impact) is arguably generous for XSS, which usually has no genuine availability effect. On balance this is a 'real but not urgent' issue: genuinely exploitable against unpatched sites and attractive for opportunistic session-theft or admin-targeting campaigns, yet gated by required user interaction and with no evidence of active exploitation or weaponization at time of analysis. Prioritize routine patching rather than emergency response. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts input containing a malicious JavaScript payload that the Team Section Block plugin fails to sanitize or output-encode. When a victim - potentially a logged-in administrator - views the affected page or clicks a crafted link, the script executes in their browser, enabling session cookie theft, admin-action forgery, or redirection. No public exploit code is referenced, so exploitation would require an attacker to independently develop the payload. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated cross-site scripting in the Team Section Block WordPress plugin (bPlugins), affecting all versions up to and including 2.0.4, lets a remote attacker supply script-bearing content that executes in a victim's browser when the affected block/page is rendered. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, unauthenticated bug whose practical severity is constrained by the mandatory victim interaction step - the payload only fires once a user (ideally a logged-in administrator) loads the injected content.
RemediationAI
No vendor-released patch has been identified at time of analysis, so the primary action is to move off the vulnerable range as soon as bPlugins publishes a fixed release beyond 2.0.4 - monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/team-section/vulnerability/wordpress-team-section-block-plugin-2-0-4-cross-site-scripting-xss-vulnerability and the WordPress.org plugin page for a version bump, then update immediately and re-verify the installed version. Until a fix lands, the most reliable compensating control is to deactivate and, if unused, remove the Team Section Block plugin entirely; the trade-off is loss of the team-display functionality, but it eliminates the vulnerable render path. If the plugin must stay live, restrict who can create or edit team blocks and treat all team-member text fields as untrusted - review existing Team Section block content for embedded script, event-handler attributes, javascript: URIs, or unexpected markup and clean it, since stored payloads persist after patching. Deploy a WordPress-aware WAF or virtual-patching rule that blocks script-bearing payloads targeting the plugin's block attributes/parameters, understanding that signature-based filtering can be bypassed with encoding tricks and may generate false positives on legitimate markup. Add a strict Content-Security-Policy (for example disallowing inline script) as a defense-in-depth layer to blunt execution if injection still occurs, accepting that CSP requires careful tuning and can break legitimate theme or plugin scripts. Finally, keep administrative sessions short-lived and use separate browser profiles for admin work to reduce the value of a successful admin-context XSS against a site running the unpatched plugin.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting) in a WordPress block plugin. The Team Section Block plugin registers a Gutenberg block that renders team-member markup (names, roles, images, bios, social links) into front-end pages; the plugin is failing to sanitize on input or escape on output for at least one of those user-controlled fields, allowing HTML/JavaScript to be reflected or persisted into the rendered page. The CPE entry cpe:2.3:a:bplugins:team_section_block:*:*:*:*:*:*:*:* uses a wildcard version, meaning the vendor/product mapping covers all tracked releases of this plugin, while the advisory scopes the vulnerable range to 2.0.4 and earlier. The CVSS vector's S:C (scope changed) indicates the injected script can affect resources beyond the vulnerable component's security authority - typically the surrounding WordPress front end or admin session context - and UI:R confirms the exploit path depends on a victim loading the malicious page or block preview. PR:N confirms no attacker authentication is needed to plant the payload, but the sparse vendor/Patchstack description does not specify whether the injection is reflected or stored, nor which parameter or block attribute is the injection point, so the exact delivery vector should be verified against the Patchstack advisory.
Know when Team Section Block gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network XSS requiring victim interaction (UI:R) with cross-context execution (S:C); C:L/I:L for browser-context data and action tampering, but A:N since XSS does not genuinely impair availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.
Executive ViewAI
The Team Section Block WordPress plugin (bPlugins), through version 2.0.4, contains a high-severity cross-site scripting flaw that can execute attacker-supplied script in a victim's browser when the affected block or page is rendered. No vendor-released patch is available, and although the flaw is unauthenticated, it requires victim interaction, leaving any organization hosting the plugin at elevated risk of administrator compromise, website defacement, or data theft. Leadership should prioritize identifying and containing affected WordPress sites to protect brand trust and operational continuity.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating or removing Team Section Block (bPlugins) versions up to and including 2.0.4, disabling the affected block rendering, restricting untrusted users from creating or editing content, deploying WAF virtual patching for script-bearing input, enforcing MFA for administrators, and monitoring content and logs for injected scripts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB