3.5
Faible
CVE-2026-8981 The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability…
Description
The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Custom Block Builder 4.3 | premières → < 4.3.0 | 4.3.0 |