CVE-2026-88824: Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings
The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Master Blocksto a version that resolves this vulnerability.Fixed in 1.5.0 - Compensating control
Restrict access to the Master Blocks REST route used to update White Label settings so unauthenticated users cannot modify it (e.g., enforce authentication at the route or block/deny unauthenticated requests at a reverse proxy/WAF).
Event History
Frequently Asked Questions
Who can exploit this issue, and whose session is at risk?
An unauthenticated user can exploit the affected REST route without needing a WordPress account. The stored script executes in the session of an administrator who visits a wp-admin page.
Which versions are affected?
Master Blocks versions before 1.5.0 are affected. The reported affected range includes versions 1.4.1 through 1.4.1.4.
What setting is involved in the attack?
The vulnerable REST route allows unauthenticated updates to plugin settings, including a White Label Settings value that is later output without escaping in the WordPress administration area.