What is the CVSS score of CVE-2026-6551?

CVE-2026-6551 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Timeline Blocks for Gutenberg CVE-2026-6551

EUVD-2026-25984 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-28 Wordfence

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 28, 2026 - 06:00 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 05:30 euvd

EUVD-2026-25984

Analysis Generated

Apr 28, 2026 - 05:30 vuln.today

CVE Published

Apr 28, 2026 - 04:28 nvd

MEDIUM 6.4

DescriptionCVE.org

The Timeline Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute of the timeline-blocks/tb-timeline-blocks block in all versions up to, and including, 1.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Timeline Blocks for Gutenberg WordPress plugin through version 1.1.10 allows authenticated contributors and above to inject arbitrary JavaScript via the 'titleTag' attribute of the timeline-blocks/tb-timeline-blocks block, executing malicious scripts whenever any user views the affected page. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied block attributes. Exploitation requires WordPress contributor-level access or higher and affects all versions up to 1.1.10.

Technical ContextAI

The vulnerability resides in the WordPress Gutenberg block registration and rendering code for the Timeline Blocks plugin. Gutenberg blocks accept block attributes that are stored as metadata within WordPress post content (serialized in HTML comments). The 'titleTag' attribute is rendered directly into the frontend without proper escaping functions such as wp_kses_post() or esc_html(). The CWE-79 (Cross-Site Scripting) root cause is improper neutralization of input during web page generation - the plugin fails to apply WordPress sanitization on input (sanitize_text_field() or equivalent) and fails to apply output escaping (esc_attr() for HTML attributes or esc_html() for text content). The affected code at lines 200, 202, and 342-343 in index.php demonstrates where titleTag is processed without proper sanitization before being output to the DOM.

RemediationAI

Update the Timeline Blocks for Gutenberg plugin to the latest available version immediately (version after 1.1.10 should contain the fix, but exact patched version is not confirmed in available data-verify on WordPress.org plugins page for the most recent release). The plugin developer (Techeshta) must implement proper input sanitization using WordPress sanitization functions (sanitize_text_field() on the 'titleTag' attribute during block registration) and output escaping using esc_attr() or esc_html() when rendering the attribute in frontend output. As a temporary compensating control on sites that cannot immediately update, restrict contributor-level and above access to users who are fully trusted, and consider using WordPress role management plugins to limit block creation/editing permissions to administrators only. Monitor post revisions and audit logs for suspicious block attributes containing script tags or event handlers. If using a Website Application Firewall (WAF), configure rules to detect and block POST requests containing script payloads in block attributes. These controls have trade-offs: restricting access reduces user collaboration; WAF rules may generate false positives. Patching remains the definitive fix.