What is the CVSS score of CVE-2026-6740?

CVE-2026-6740 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Nexter Blocks CVE-2026-6740

EUVD-2026-42232 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-08 Wordfence

GHSA-7825-vqgh-fjg4

WordPress XSS Wordpress Plugin Nexter Blocks Gutenberg Blocks Page Builder Ai Website Builder Posimyththemes

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS impact requires a victim to navigate to the injected page (UI:R); scope change is accurate as script executes in victim browser context (S:C); contributor authentication is required (PR:L).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 13:26 vuln.today

CVE Published

Jul 08, 2026 - 12:33 nvd

MEDIUM 6.4

DescriptionCVE.org

The Nexter Blocks - Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentIcon' parameter in all versions up to, and including, 4.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the Nexter Blocks - Gutenberg Blocks, Page Builder & AI Website Builder WordPress plugin (versions through 4.7.4) enables authenticated contributors to persistently inject malicious JavaScript via the unsanitized 'commentIcon' parameter, executing in any visitor's browser on affected pages. The CVSS Scope:Changed metric reflects that attacker-controlled code crosses trust boundaries into the victim's browser session, enabling session hijacking, credential theft, or unauthorized actions on behalf of privileged users such as site administrators. No public exploit code or CISA KEV listing was identified at time of analysis.

Technical ContextAI

Nexter Blocks is a WordPress Gutenberg page builder plugin developed by PosimythThemes (CPE: cpe:2.3:a:posimyththemes:nexter_blocks_-_gutenberg_blocks,_page_builder_&_ai_website_builder:*:*:*:*:*:*:*:*). The vulnerability resides in the tp-post-meta block's index.php handler - identifiable via the trac changeset at plugins.trac.wordpress.org/changeset/3512686 - where the 'commentIcon' parameter is accepted without input sanitization or output escaping before being rendered into page HTML. This is a textbook instance of CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS Scope:Changed (S:C) metric is significant: the injected script executes in the victim's browser context, a separate security principal from the WordPress server, meaning the impact radius extends beyond the plugin's own data to whatever the victim's browser session can access.

RemediationAI

Update the Nexter Blocks plugin to a version beyond 4.7.4 via the WordPress plugin dashboard or wp-cli. A code-level fix was committed upstream per trac changeset 3512686 (https://plugins.trac.wordpress.org/changeset/3512686/the-plus-addons-for-block-editor/trunk/classes/blocks/tp-post-meta/index.php), though the specific released patched version number is not independently confirmed from available data - verify the current release version in the WordPress.org plugin repository before deploying. If immediate patching is not possible, reduce risk by auditing and pruning contributor-level accounts to only trusted users, as this directly limits the attacker population; note this is a mitigation, not a fix, and leaves the vulnerability present. A WAF rule blocking script injection patterns in the commentIcon parameter can provide additional layered defense but may interfere with legitimate plugin functionality and should be tested before production deployment. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f5184598-b0bd-4026-971c-da36d79497df for additional guidance.