CVE-2026-88824

CVE-2026-88824 affects the Master Blocks WordPress plugin, versions 1.4.1 through 1.4.1.4 (before 1.5.0 ). A missing authorisation check on one of the plugin's REST routes allows unauthenticated users to update its settings. Among the updatable settings is a value that is output unescaped in the ...