CVE-2026-114534

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

CVE-2026-114534 Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

CVE-2026-114534

The Drupal Block Attributes module (versions 0.0.0 to 2.1.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of custom attributes. An attacker can inject malicious scripts into block attributes, though the risk is mitigated by the requirement for the administe...

CVE-2026-114534

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

CVE-2026-114534 Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

EUVD-2026-113540

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

CVE-2026-114534: Drupal Block Attributes: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block…

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

EUVD-2026-111615

The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content block attribute icon.view / icon.layout / icon.gap' parameter in all versions up to, and including, 2.2.27 due t...

DRUPAL-CONTRIB-2026-232

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

PT-2026-120909

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

CVE-2026-85002

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

CVE-2026-96895 WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2026-96895 WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2026-96895

The WP YouTube Lyte WordPress plugin (versions before 1.7.31 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape certain attributes of YouTube embed blocks before they are output as HTML attributes during block rendering. This flaw allows users with perm...

CVE-2026-85002

The EmbedPress WordPress plugin, in versions before 4.6.7 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape one of its block attributes before outputting it inside an HTML attribute, specifically identified in the Instagram Carousel Block Attributes . ...

EUVD-2026-87888

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

CVE-2026-85002: Improper Neutralization of Input During Web Page Generation

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

CVE-2026-88994 All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

GO-2026-6404 SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents in github.com/siyuan-note/siyuan/kernel

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes name, alias, memo, custom fields of protected documents in github.com/siyuan-note/siyuan/kernel...