EUVD-2026-23650Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Page Builder Gutenberg Blocks - CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via external iCal feed data in all versions up to, and including, 3.1.16 due to insufficient output escaping of event titles, descriptions, and locations fetched from external iCal feeds in the Events block rendering function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in CoBlocks Page Builder plugin for WordPress allows authenticated Contributor-level users to inject malicious scripts via external iCal feed data in the Events block, executing arbitrary JavaScript in pages visited by any user. The vulnerability exists in all versions through 3.1.16 due to insufficient output escaping of event titles, descriptions, and locations. CVSS 6.4 reflects limited direct impact (confidentiality and integrity) but broad scope across WordPress installations, and no public exploit code or active exploitation has been confirmed at this time.
Technical ContextAI
The CoBlocks Events block (src/blocks/events/index.php) integrates external iCal calendar feeds into WordPress pages. When rendering event data fetched from remote calendars, the plugin fails to properly escape HTML/JavaScript context in three fields: event titles (line 218), descriptions (line 245-246), and locations (line 255). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation) - the plugin retrieves untrusted data from external iCal sources and outputs it directly into the DOM without WordPress escaping functions like esc_html() or wp_kses_post(). An attacker with Contributor-level or higher WordPress role can craft a malicious iCal feed URL, configure the Events block to fetch from that feed, and embed arbitrary JavaScript in event metadata. When the block renders on any page, the unescaped payload executes in the browsers of all page visitors.
RemediationAI
Update CoBlocks to version 3.1.17 or later, which adds proper output escaping to event titles, descriptions, and locations in the Events block rendering function (verified via plugins.trac.wordpress.org changeset comparing 3.1.16 and 3.1.17 tags). The patch applies WordPress standard escaping functions to the vulnerable output points at lines 218, 245-246, and 255 in src/blocks/events/index.php. If immediate patching is not possible, disable the Events block across all pages and posts until an upgrade is available, or restrict Contributor-level role access to only trusted editorial staff through role management plugins such as Members or User Role Editor. Additionally, audit all existing pages using the Events block with external iCal feeds to identify any injected malicious content and remove compromised feeds or blocks. Monitor iCal feed sources for signs of tampering (unexpected script tags, unusual event content) and consider using Content Security Policy (CSP) headers with restricted script-src directives to mitigate stored XSS impact, though CSP is not a substitute for patching. The disabling workaround reduces functionality and requires manual page editing; patching is the strongly preferred path.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today