CVE-2026-125451: WordPress B Blocks plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

An attacker needs network access, a low-privileged account, and user interaction to exploit the stored XSS condition. The vulnerability affects confidentiality, integrity, and availability beyond the initially compromised security scope.

Q: Which versions are affected?

B Blocks versions through 2.1.15 are affected. The available data does not identify a fixed version.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.15.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bPlugins B Blocks (b-blocks) to a version that resolves this vulnerability.
Fixed in 2.1.16

Event History

Nov 11, 2026

CVE Published

via MITRE·11:38 AM

Data Sourced

via MITRE·11:38 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs network access, a low-privileged account, and user interaction to exploit the stored XSS condition. The vulnerability affects confidentiality, integrity, and availability beyond the initially compromised security scope.

Which versions are affected?

B Blocks versions through 2.1.15 are affected. The available data does not identify a fixed version.

CVE-2026-125451: WordPress B Blocks plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected?