CVE-2026-0894: Content Blocks (Custom Post Widget) <= 3.3.9 - Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode
The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contentblock shortcode in all versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping on user supplied values consumed from user-created content blocks. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0894?
CVE-2026-0894 has a medium severity rating due to its potential to allow stored cross-site scripting attacks.
How do I fix CVE-2026-0894?
To fix CVE-2026-0894, update the Content Blocks (Custom Post Widget) plugin to version 3.4.0 or later.
What is the risk associated with CVE-2026-0894?
The risk associated with CVE-2026-0894 includes the possibility of attackers executing malicious scripts in the context of the user's session.
Who is affected by CVE-2026-0894?
CVE-2026-0894 affects all users of the Content Blocks (Custom Post Widget) plugin for WordPress running versions up to 3.3.9.
Is user authentication required to exploit CVE-2026-0894?
Yes, CVE-2026-0894 requires user authentication, as it is an authenticated stored cross-site scripting vulnerability.