EUVD-2026-65171
GHSA-v5q6-9xm9-3mc9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network delivery with scope change into victim browser justifies AV:N/PR:N/S:C; availability impact removed as XSS does not credibly cause service disruption here.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.
AnalysisAI
Unauthenticated XSS in the Toolset Blocks WordPress plugin (versions through 1.6.26) allows remote attackers to inject malicious scripts into pages rendered by the plugin without any prior authentication. The CVSS vector's scope-change indicator (S:C) signals that injected code executes in the victim's browser context outside the vulnerable component itself, making administrator session hijacking a realistic secondary impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Based on CVSS PR:N, no authentication is required to inject or deliver the XSS payload, meaning any unauthenticated network-accessible user can attempt exploitation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score reflects a network-reachable, low-complexity attack requiring no authentication but demanding victim interaction (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running Toolset Blocks <= 1.6.26 and crafts a URL or form submission containing a JavaScript payload targeting a vulnerable block parameter or input field exposed by the plugin. The attacker then distributes the crafted link via phishing to a site administrator. … |
| Remediation | The primary remediation is to update the Toolset Blocks plugin to a version above 1.6.26 via the WordPress admin dashboard or WP-CLI. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress instances for Toolset Blocks versions 1.6.26 or earlier and immediately disable the plugin until vendor remediation is available. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today