Premium Blocks CVE-2026-94118

Requires an authenticated WordPress account with at least Contributor privileges on a site running Premium Blocks - Gutenberg Blocks for WordPress version 2.3.17 or earlier. Exploitation is gated by user interaction (UI:R): a higher-privileged user such as an editor or administrator must view or preview the attacker's injected block content in wp-admin for the stored script to execute. Practical limiting factors are the need for a foothold account (sites with closed registration or no untrusted authors are largely insulated) and the victim-interaction requirement; there is no unauthenticated path.

This is a moderate-severity stored/contributor Cross-Site Scripting flaw (CWE-79) in a WordPress block plugin, scored 6.5 by the vendor with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The key risk-limiting signals are PR:L (an authenticated Contributor-level account is required) and UI:R (a victim - typically an editor or administrator - must view the injected content for the payload to fire). No EPSS score is provided, there is no CISA KEV listing, and no public proof-of-concept is referenced (the only reference is the Patchstack advisory), so this is 'no public exploit identified at time of analysis.' The S:C (scope change) reflects that script executing in a higher-privileged user's authenticated browser session crosses a trust boundary, but real-world impact is bounded to C:L/I:L/A:L. Overall this is a real but low-urgency issue: it is not a high-CVSS-but-fictional problem, yet it is far from a mass-exploitation candidate because it needs a foothold account plus victim interaction. The A:L component is questionable for a reflected/stored XSS and is likely vendor over-scoring; realistic impact is confidentiality/integrity of the admin session, not availability. Prioritize patching on multi-author sites where untrusted Contributor accounts exist; deprioritize on single-author/closed-registration sites.

An attacker who holds (or registers for) a Contributor account on a WordPress site running Premium Blocks ≤ 2.3.17 crafts a post or block containing a malicious script payload in an inadequately sanitized block attribute. When an editor or administrator previews or opens that content in wp-admin, the script executes in their authenticated browser session, enabling session/cookie theft or admin-context actions. No public PoC is referenced, and exploitation requires the low-privilege account plus victim interaction (UI:R).