Magazine Blocks CVE-2026-75016

Requires an authenticated account with contributor-level capability or higher on a WordPress site running Magazine Blocks (by wpblockart) version 1.8.6 or earlier, with the block editor available to that account. The attacker must be able to add/edit content containing a News Ticker block, whose clientId attribute reaches NewsTicker::render() unescaped. Exploitation is limited by this authentication requirement (PR:L), so single-author or tightly-controlled sites are not exposed to arbitrary attackers; sites permitting open contributor registration, guest posting, or lower-trust editorial roles are the realistic risk surface. No user interaction is needed to store the payload, and it fires automatically when any viewer loads the injected page.

This is a genuine but moderate-priority issue, not an inflated high-CVSS finding. The vendor CVSS 3.1 vector (6.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) is well-calibrated and I concur with it: network attack vector and low complexity are offset by PR:L (contributor-level authentication is required - this is NOT unauthenticated). The scope change (S:C) plus C:L/I:L correctly reflect stored XSS where injected script crosses from the plugin's rendering context into any viewer's browser session. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data - exploitation status is therefore 'no public exploit identified at time of analysis.' However, the Wordfence advisory and the trac source lines (NewsTicker.php#L43/#L106) plus the fix changeset (3656574) effectively document the vulnerable code path, lowering the bar for exploit development. The realistic risk is bounded by the contributor-access precondition, which limits this to multi-author sites, membership sites, or environments where lower-trust accounts can be registered. No signals conflict: the CVSS network vector is consistent with a web-delivered stored-XSS payload.

An attacker holding (or self-registering) a contributor-level account on a WordPress site running Magazine Blocks <=1.8.6 inserts a News Ticker block and supplies a malicious clientId value containing a break-out sequence and script payload. Because NewsTicker::render() concatenates clientId into an HTML class attribute without esc_attr(), the payload is stored and later executed in the browser of any user - including an editor or administrator - who views the injected page. No public POC is identified, but the referenced source lines and fix changeset disclose the exact vulnerable sink.