CVE-2026-111843: WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Rootblox pluginto a version that resolves this vulnerability.Fixed in 1.0.8
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack vector indicates network access and low privileges are required, and exploitation also requires user interaction. The available data does not identify the specific WordPress role or action needed.
What versions are affected?
Rootblox versions through 1.0.7 are affected. No fixed version is provided in the available data.
What is the likely impact if exploitation succeeds?
This is a stored XSS issue with low confidentiality, integrity, and availability impact in the provided vector. Because scope is changed, the impact may extend beyond the vulnerable plugin's immediate security boundary.