CVE-2026-94632: WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
blockstrap-page-builder-blocksto a version that resolves this vulnerability.Fixed in 0.1.59
Event History
Frequently Asked Questions
Does exploiting this issue require an authenticated WordPress account?
No. The published vector lists privileges required as none, so an attacker does not need authenticated access to exploit it.
Does an attack require someone to interact with attacker-controlled content?
Yes. The published vector indicates user interaction is required. This is a reflected XSS issue, so exploitation depends on a user interacting with a crafted request or link.
What security impact is indicated by the published severity vector?
The issue is rated high with a 7.1 score. The vector indicates low potential impact to confidentiality, integrity, and availability, with scope changed.