Toolset Blocks CVE-2026-78264

Based on CVSS PR:N, no authentication is required to inject or deliver the XSS payload, meaning any unauthenticated network-accessible user can attempt exploitation. The critical limiting condition is UI:R: a victim must actively interact with the attack vector - typically by clicking a crafted link or visiting a page where a stored payload has been injected. Exploitation is further bounded to WordPress installations with the Toolset Blocks plugin installed and active in versions at or below 1.6.26. The specific plugin feature, block type, or parameter vector containing the unsanitized input is not disclosed in the available data, which limits precise configuration-level scoping. No special server-side configuration beyond running the affected plugin version appears required. The primary exploitation limiter is the need for victim interaction, making mass automated exploitation less likely than targeted phishing against site administrators.

The CVSS 7.1 score reflects a network-reachable, low-complexity attack requiring no authentication but demanding victim interaction (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The combination of PR:N and S:C is the most concerning signal: anyone on the internet can craft the payload, and the scope change means the impact lands on the victim's browser session - potentially an administrator's - rather than the plugin itself. The UI:R requirement provides a meaningful friction point, as the attacker must social-engineer a victim into visiting a crafted or tainted page, which reduces opportunistic mass exploitation but does not eliminate targeted campaigns. No EPSS probability was provided in the input data, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at this time. No POC code has been identified. For smaller organizations managing WordPress sites - even a mid-sized municipal IT team managing several public-facing portals should treat this as a meaningful risk given the ease of phishing administrators - the real-world priority depends heavily on whether Toolset Blocks is exposed to untrusted user input on public-facing pages. The A:L availability impact in the vendor-provided CVSS vector is not well-substantiated by the description and may be conservative; see assessed vector below.

An attacker identifies a WordPress site running Toolset Blocks <= 1.6.26 and crafts a URL or form submission containing a JavaScript payload targeting a vulnerable block parameter or input field exposed by the plugin. The attacker then distributes the crafted link via phishing to a site administrator. When the administrator opens the link while logged into WordPress, the injected script executes in their browser, capturing their session cookie or performing privileged actions - such as creating a rogue admin account - via the WordPress REST API. No public POC has been identified, but the attack technique is standard and well-understood for WordPress XSS vulnerabilities of this class.