Canvas WordPress Plugin CVE-2026-9629

Exploitation requires the attacker to possess a valid WordPress account with at least contributor-level role on the target site - anonymous or unauthenticated access is insufficient. The Canvas plugin must be installed, activated, and running version 2.5.2 or earlier. The attacker must have permission to create or edit posts or pages that use the block-section-heading Gutenberg block and must be able to supply a custom value to its 'tag' parameter. Execution of the injected payload additionally requires a separate victim user (any role, including unauthenticated visitors) to load the affected page. Sites that do not grant contributor or higher roles to untrusted parties, or that have no externally-registered contributor accounts, face negligible exploitation risk regardless of plugin version.

The NVD CVSS 3.1 base score of 6.4 (Medium) is underpinned by a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The scope change (S:C) is the most significant signal here: even though direct confidentiality and integrity impacts are individually rated Low, the cross-context execution against arbitrary site visitors substantially amplifies real-world impact beyond what a '6.4' headline suggests. The PR:L metric confirms exploitation requires at minimum contributor-level WordPress credentials, which meaningfully limits the attacker pool to those with existing authenticated access. No EPSS score was included in the provided intelligence, so numeric exploitation probability cannot be stated. KEV status is absent, meaning no active exploitation has been confirmed by CISA. No standalone POC exploit code is referenced, though Wordfence's disclosure includes direct source-code line references that substantially lower the bar for independent reconstruction. Overall, this is a genuine medium-priority issue for sites that grant contributor access to untrusted or semi-trusted users - not a theoretical high-CVSS noise item.

An attacker registers or compromises a WordPress contributor account on the target site, then creates or edits a post using the Canvas block-section-heading Gutenberg block, setting the 'tag' parameter to a crafted XSS payload such as a script tag or event-handler attribute. Once the post is published or saved, any authenticated or unauthenticated visitor who loads that page triggers the script in their browser, allowing the attacker to silently harvest session cookies or administrator credentials without further interaction. The Wordfence source-code disclosure at lines 13 and 32 of render.php provides sufficient technical detail to construct such a payload without a separate standalone POC.