Responsive Blocks EUVD-2026-100978

Requires that the site runs the Responsive Blocks plugin (before 2.3.0) with its Form block deployed and reachable by anonymous visitors, and that the plugin is configured to send HTML notification emails to the site owner. Exploitation is remote and unauthenticated (PR:N) but is fundamentally gated by user interaction (UI:R): the injected HTML has no effect until the site owner opens the notification email and acts on the attacker-supplied content (e.g., clicks a phishing link). Limiting factors: no server-side code execution results, impact is confined to the content of emails sent to the operator, and sites not using the Form block or not sending HTML emails are not affected.

This is a moderate, not critical, issue. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) reflects an unauthenticated, network-reachable HTML injection, but the UI:R requirement is decisive: exploitation does not execute in the attacker's context - it depends on the site owner opening and acting on the injected content in a notification email. No EPSS score and no KEV listing were provided; this is not confirmed to be actively exploited in the wild. The one positive signal is that public exploit detail exists via WPScan (POC=YES), lowering the effort to reproduce, but POC availability is distinct from active exploitation. The real-world impact is social-engineering (phishing links rendered in a trusted admin email), not direct code execution or data compromise on the server, so this is a genuine but lower-tier priority - patch in routine cycles rather than emergency. Note: the input provides CWE as N/A and the 'Code Injection' tag overstates the mechanism, which is HTML/content injection into email rather than server-side code execution; the CVSS C:L/I:L should be read as downstream phishing risk, not direct server compromise.

An unauthenticated attacker submits the plugin's Form block with malicious HTML (e.g., a fake 'reset your password' phishing link) in an unsanitized field value. The site generates a notification email to the owner, embedding the attacker's HTML unescaped; when the owner opens the trusted email and clicks the injected link, they are led to a credential-harvesting or malicious site. A public write-up/POC exists via WPScan, making reproduction straightforward.