CVE-2026-8981

The Custom Block Builder (also referred to as Lazy Blocks ) WordPress plugin before version 4.3.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is an inconsistent check of the unfiltered_html capability across all paths that write to its block template code fields. This allo...