CVE-2026-116400: WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and user interaction to exploit the vulnerability. The attack can be performed over the network with low attack complexity.

Q: What are the likely impacts of successful exploitation?

Successful stored XSS can affect confidentiality, integrity, and availability at a low level. The scope may extend beyond the vulnerable component, as indicated by the changed-scope CVSS vector.

Q: Which versions are affected?

Button Block versions through 1.2.7 are affected. The available data does not identify a fixed version.

Published Oct 26, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7.

Affected Software

1 affected component

bPlugins Button Block<=1.2.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade button-block to a version that resolves this vulnerability.
Fixed in 1.2.8

Event History

Oct 26, 2026

CVE Published

via MITRE·05:27 PM

Data Sourced

via MITRE·05:27 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and user interaction to exploit the vulnerability. The attack can be performed over the network with low attack complexity.

What are the likely impacts of successful exploitation?