Skip to content
Sign in
3.5 Low

CVE-2026-8981 The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability…

Description

The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.

Affected products and versions

Product Affected versions Fixed in
Custom Block Builder 4.3 earliest → < 4.3.0 4.3.0

Other CVEs of Custom Block Builder

The 2 CVEs of Custom Block Builder →
CVE-2024-12878 The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it… 7.1 High
Track this CVE