CVE-2026-94632: WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability

Q: Does exploiting this issue require an authenticated WordPress account?

No. The published vector lists privileges required as none, so an attacker does not need authenticated access to exploit it.

Q: Does an attack require someone to interact with attacker-controlled content?

Yes. The published vector indicates user interaction is required. This is a reflected XSS issue, so exploitation depends on a user interacting with a crafted request or link.

Q: What security impact is indicated by the published severity vector?

The issue is rated high with a 7.1 score. The vector indicates low potential impact to confidentiality, integrity, and availability, with scope changed.

Published Oct 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58.

Affected Software

1 affected component

Stiofan BlockStrap Page Builder - Bootstrap Blocks<=0.1.58

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade blockstrap-page-builder-blocks to a version that resolves this vulnerability.
Fixed in 0.1.59

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Does exploiting this issue require an authenticated WordPress account?

No. The published vector lists privileges required as none, so an attacker does not need authenticated access to exploit it.

Does an attack require someone to interact with attacker-controlled content?

Yes. The published vector indicates user interaction is required. This is a reflected XSS issue, so exploitation depends on a user interacting with a crafted request or link.

What security impact is indicated by the published severity vector?

The issue is rated high with a 7.1 score. The vector indicates low potential impact to confidentiality, integrity, and availability, with scope changed.

CVE-2026-94632: WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploiting this issue require an authenticated WordPress account?

Does an attack require someone to interact with attacker-controlled content?

What security impact is indicated by the published severity vector?

Company

Resources

Contact

Frequently Asked Questions

Does exploiting this issue require an authenticated WordPress account?

Does an attack require someone to interact with attacker-controlled content?

What security impact is indicated by the published severity vector?