CVE-2026-85679: Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because registerIncoming() is hooked on restrequestbeforecallbacks and runs before WordPress evaluates the route's permissioncallback, meaning any unauthenticated POST, PUT, or PATCH request to a /wp/v2/global-styles route can trigger the vulnerable code path.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can reach the vulnerable code path. No WordPress account or prior authorization is required because the affected handler runs before WordPress evaluates the route permission callback.
Which requests can trigger the vulnerable behavior?
Unauthenticated POST, PUT, or PATCH requests to a /wp/v2/global-styles route can trigger it. The injection vector is the styles.blocks block type key.
What is the impact if exploitation succeeds?
An attacker can store arbitrary web scripts in pages. Those scripts execute when a user accesses an injected page, potentially affecting the confidentiality and integrity of that user's session or actions.
Which Extendify versions are affected?
All Extendify versions up to and including 3.1.6 are affected.