CVE-2026-108168: WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability

Q: What access and interaction are needed to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that a user must interact with attacker-controlled content. The attack can be performed over the network with low attack complexity.

Q: What is the potential impact if exploitation succeeds?

This is a stored XSS issue, meaning injected script may be retained and later executed when affected content is viewed. The supplied CVSS metrics indicate low potential impact to confidentiality, integrity, and availability, with scope changed.

Q: Which plugin versions are affected?

Custom Query Blocks versions through 5.6.0 are affected. The available data does not identify a fixed version.

Published Oct 12, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.

Affected Software

1 affected component

DLX Plugins Custom Query Blocks<=5.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Custom Query Blocks to a version that resolves this vulnerability.
Fixed in 5.7.0

Event History

Oct 12, 2026

CVE Published

via MITRE·08:22 AM

Data Sourced

via MITRE·08:22 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and interaction are needed to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and that a user must interact with attacker-controlled content. The attack can be performed over the network with low attack complexity.

What is the potential impact if exploitation succeeds?