CVE-2026-88993: All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute
Published Sep 18, 2026
·Updated
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
Affected Software
1 affected component
WordPress plugin: All Bootstrap Blocks<=1.3.31
Event History
Sep 18, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A user with Contributor-level access or higher can exploit it. The vulnerable input is the areoi/button block's type attribute.
2
When does the injected script execute?
The script executes when someone views content containing the malicious block attribute. This is a stored XSS issue, so the payload is saved in WordPress content before it runs.
3
Which versions are affected?
All Bootstrap Blocks versions through 1.3.31 are affected.