CVE-2026-104400: WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

An attacker needs at least low-level privileges and must be able to induce a user to interact with the malicious content. The issue is remotely reachable and has low attack complexity.

Q: Which versions are affected?

B Blocks versions through 2.1.8 are affected. The available data does not identify a fixed version.

Q: What is the potential impact?

This is a stored XSS issue. Successful exploitation can affect confidentiality, integrity, and availability at low impact, with scope changed.

Published Oct 5, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.

Affected Software

1 affected component

bPlugins B Blocks<=2.1.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress B Blocks to a version that resolves this vulnerability.
Fixed in 2.1.9

Event History

Oct 5, 2026

CVE Published

via MITRE·08:07 AM

Data Sourced

via MITRE·08:07 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs at least low-level privileges and must be able to induce a user to interact with the malicious content. The issue is remotely reachable and has low attack complexity.

Which versions are affected?