EUVD-2026-13996
GHSA-v6ph-2p6j-56h7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The WPFAQBlock- FAQ & Accordion Plugin For Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'wpfaqblock' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The WPFAQBlock plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the 'class' parameter of the 'wpfaqblock' shortcode, affecting all versions up to and including 1.1. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that persists in pages and executes for all users visiting those pages. With a CVSS score of 6.4 and low attack complexity, this represents a moderate-to-significant risk for WordPress installations using this plugin, particularly on multi-author sites where contributor accounts may be compromised or malicious.
Technical ContextAI
The vulnerability stems from insufficient input sanitization and output escaping of user-supplied attributes in the 'wpfaqblock' shortcode handler, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected product is the WPFAQBlock – FAQ & Accordion Plugin For Gutenberg (CPE: cpe:2.3:a:creativewerkdesigns:wpfaqblock–_faq_&_accordion_plugin_for_gutenberg), which integrates with WordPress's Gutenberg block editor. The vulnerable code path has been identified in the template-1.php file within the includes/templates directory, where the 'class' parameter is passed directly to HTML output without proper escaping functions such as esc_attr(). This allows an attacker to break out of the HTML attribute context and inject arbitrary script tags or event handlers.
RemediationAI
Immediately deactivate and remove the WPFAQBlock plugin from all affected WordPress installations until a security patch is released by the vendor. For sites that depend on the plugin's functionality, monitor the official WordPress plugin repository and Wordfence Intelligence feed for patch availability at https://www.wordfence.com/threat-intel/vulnerabilities/id/3a3147b5-0362-4299-8339-655eaade948e. As an interim mitigation, restrict Contributor-level and above account access to trusted personnel only, audit recent content changes for injected scripts in pages using the shortcode, and consider implementing a Web Application Firewall (WAF) rule to detect and block malicious class attribute patterns in shortcode parameters. If the plugin remains active pending a patch, limit its use to administrative or read-only pages and monitor site logs for suspicious script execution.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today