CVE-2026-97315: Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can submit data through a Responsive Blocks Form block can inject arbitrary HTML into the notification email sent to the site owner. No account or elevated privileges are required.
What needs to happen for the injected content to have an effect?
A site owner must receive and interact with the HTML notification email. The documented impact includes phishing links placed in that email.
Are all Responsive Blocks installations affected?
The issue affects Responsive Blocks versions before 2.3.0 where Form block submissions are included in HTML notification emails. Version 2.3.0 is not described as affected.
What can be done before updating?
Limit or disable publicly accessible Responsive Blocks Form blocks, or disable their HTML notification emails if the plugin configuration allows it. Treat form notification emails as untrusted input and do not follow links contained in submitted values.