Toolset Blocks
Monthly
Unauthenticated XSS in the Toolset Blocks WordPress plugin (versions through 1.6.26) allows remote attackers to inject malicious scripts into pages rendered by the plugin without any prior authentication. The CVSS vector's scope-change indicator (S:C) signals that injected code executes in the victim's browser context outside the vulnerable component itself, making administrator session hijacking a realistic secondary impact. Reported by Patchstack and tracked under EUVD-2026-65171; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated XSS in the Toolset Blocks WordPress plugin (versions through 1.6.26) allows remote attackers to inject malicious scripts into pages rendered by the plugin without any prior authentication. The CVSS vector's scope-change indicator (S:C) signals that injected code executes in the victim's browser context outside the vulnerable component itself, making administrator session hijacking a realistic secondary impact. Reported by Patchstack and tracked under EUVD-2026-65171; no public exploit code or CISA KEV listing has been identified at time of analysis.