CVE-2026-16623

The CVE-2026-16623 entry describes a PHP code-injection flaw in the Create Block WordPress plugin prior to 2.10.0. A multisite subsite administrator (with limited PHP file-edit capability) can inject and execute arbitrary PHP because user-supplied text isn’t properly escaped before being written ...