CVE-2026-88824

CVE-2026-88824 affects the Master Blocks WordPress plugin, versions 1.4.1 through 1.4.1.4 (before 1.5.0 ). A missing authorisation check on one of the plugin's REST routes allows unauthenticated users to update its settings. Among the updatable settings is a value that is output unescaped in the ...

CVE-2026-88824 Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...