CVE-2026-110290: WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute

Q: Who can exploit this issue?

An attacker needs an authenticated WordPress account with Contributor-level access or higher. They must be able to create or modify content containing the affected block.

Q: What is required to trigger the vulnerable code path?

The attacker must supply block JSON that sets the undeclared is_widget flag to 1. This causes the plugin to place the attacker-controlled instance_id value, derived from other_attributes, into an HTML class attribute without escaping.

Q: What is the impact after malicious content is saved?

The injected script executes in the browser of users who access the affected page. The issue can expose or alter information available in that user’s browser session, but does not affect availability.

Q: How can administrators identify potentially affected content?

Review pages and posts created or edited by Contributor-level or higher users for WebberZone Top 10 block JSON containing is_widget set to 1, especially where other_attributes or the resulting instance_id value is unexpected.

Published Oct 16, 2026

Updated

The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'otherattributes (parsed to inject instanceid) + undeclared iswidget' parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires setting the undeclared iswidget flag to '1' via block JSON, which activates the vulnerable code path that concatenates the attacker-controlled instanceid value into an unescaped HTML class attribute.

Affected Software

1 affected component

WebberZone Top 10 — Popular Posts<=4.5.2

Event History

Oct 16, 2026

CVE Published

via MITRE·06:41 AM

Data Sourced

via MITRE·06:41 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated WordPress account with Contributor-level access or higher. They must be able to create or modify content containing the affected block.

What is required to trigger the vulnerable code path?

The attacker must supply block JSON that sets the undeclared is_widget flag to 1. This causes the plugin to place the attacker-controlled instance_id value, derived from other_attributes, into an HTML class attribute without escaping.

What is the impact after malicious content is saved?

The injected script executes in the browser of users who access the affected page. The issue can expose or alter information available in that user’s browser session, but does not affect availability.

How can administrators identify potentially affected content?

Review pages and posts created or edited by Contributor-level or higher users for WebberZone Top 10 block JSON containing is_widget set to 1, especially where other_attributes or the resulting instance_id value is unexpected.

CVE-2026-110290: WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is required to trigger the vulnerable code path?

What is the impact after malicious content is saved?

How can administrators identify potentially affected content?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is required to trigger the vulnerable code path?

What is the impact after malicious content is saved?

How can administrators identify potentially affected content?