BlockStrap Page Builder EUVD-2026-95616

Exploitation requires an unauthenticated attacker to trick a user into clicking a crafted link or loading an attacker-controlled request against a vulnerable BlockStrap Page Builder endpoint (UI:R), after which unsanitized input is reflected into the generated page. Limiting factors: the mandatory victim interaction means there is no automatic/wormable exploitation; impact is confined to the victim's browser session in the site's context (session theft, forced actions) rather than direct server compromise; and the WordPress site must be running the plugin at version 0.1.58 or earlier. The specific vulnerable parameter is not named in the available data.

This is a reflected cross-site scripting (CWE-79) flaw in the BlockStrap Page Builder WordPress plugin, rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network attack vector and PR:N (no privileges) make it reachable by unauthenticated remote attackers, but the UI:R requirement means a victim must click a crafted link or visit an attacker-controlled page, which materially lowers real-world risk compared to a fully automatable server-side flaw. The elevated 7.1 score is driven largely by S:C (scope change - script executes in the victim's browser context rather than the vulnerable server) and the triple L impact on C/I/A, which is Patchstack's standard modeling for reflected XSS rather than evidence of severe system compromise. No EPSS score, CISA KEV listing, SSVC decision, or public POC was supplied in the input, so no public exploit identified at time of analysis and no active-exploitation signal exists. Net assessment: a legitimate but lower-tier priority - the combination of a niche plugin, required user interaction, and absence of any exploitation evidence suggests this is a patch-in-normal-cycle item rather than an emergency, notwithstanding the 'High' CVSS number.

An attacker crafts a malicious URL targeting a vulnerable plugin endpoint that reflects attacker-controlled input into the page without proper encoding, then lures a site visitor or logged-in administrator into clicking it (e.g., via phishing or a malicious post). When the victim's browser renders the response, the injected JavaScript executes in the context of the WordPress site, enabling session/cookie theft or actions on the victim's behalf. No public proof-of-concept was provided in the available data.