CVE-2026-118983

The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post,...

CVE-2026-118983 VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks

The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post,...

EUVD-2026-116739

The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post,...

CVE-2026-114534

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

CVE-2026-114534

The Drupal Block Attributes module is vulnerable to Stored Cross-site Scripting (XSS) in versions 0.0.0 through 2.1.0 . The root cause is the improper neutralization of input during web page generation, as the module fails to sufficiently sanitize custom attributes. A practical consequence is tha...

CVE-2026-114534 Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

CVE-2026-114534

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

CVE-2026-114534 Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

EUVD-2026-113540

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

CVE-2026-114534: Drupal Block Attributes: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block…

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Block Attributes allows Stored XSS. This issue affects Block Attributes versions: from 0.0.0 to 2.1.0...

EUVD-2026-111615

The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content block attribute icon.view / icon.layout / icon.gap' parameter in all versions up to, and including, 2.2.27 due t...

DRUPAL-CONTRIB-2026-232

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

PT-2026-120909

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232

This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...

CVE-2026-85002

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

CVE-2026-96895 WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2026-96895 WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

CVE-2026-96895

The WP YouTube Lyte WordPress plugin (versions before 1.7.31 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape certain attributes of YouTube embed blocks before they are output as HTML attributes during block rendering. This flaw allows users with perm...

EUVD-2026-87888

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

CVE-2026-85002

The EmbedPress WordPress plugin, in versions before 4.6.7 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape one of its block attributes before outputting it inside an HTML attribute, specifically identified in the Instagram Carousel Block Attributes . ...