CVE-2026-1614

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1614", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-29T12:57:27.474Z", "datePublished": "2026-02-25T06:54:51.794Z", "dateUpdated": "2026-04-08T16:37:39.152Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:39.152Z"}, "affected": [{"vendor": "eaglethemes", "product": "Rise Blocks \u2013 A Complete Gutenberg Page Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Rise Blocks \u2013 A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018logoTag\u2019 Site Identity block attribute in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Rise Blocks \u2013 A Complete Gutenberg Page Builder <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Identity Block Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/188f00f8-82f2-4166-9d6e-af996fe66422?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/rise-blocks/tags/3.7/classes/blocks/site-identity.php#L364"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2026-01-03T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-24T18:45:53.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T21:09:30.178596Z", "id": "CVE-2026-1614", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:09:39.421Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1614", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T21:09:30.178596Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T21:09:35.500Z"}}], "cna": {"title": "Rise Blocks \u2013 A Complete Gutenberg Page Builder <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Identity Block Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "eaglethemes", "product": "Rise Blocks \u2013 A Complete Gutenberg Page Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-03T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-24T18:45:53.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/188f00f8-82f2-4166-9d6e-af996fe66422?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/rise-blocks/tags/3.7/classes/blocks/site-identity.php#L364"}], "descriptions": [{"lang": "en", "value": "The Rise Blocks \u2013 A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018logoTag\u2019 Site Identity block attribute in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:39.152Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1614", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:37:39.152Z", "dateReserved": "2026-01-29T12:57:27.474Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-25T06:54:51.794Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Rise Blocks \u2013 A Complete Gutenberg Page Builder", "vendor": "eaglethemes", "versions": [{"lessThanOrEqual": "3.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Rise Blocks \u2013 A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018logoTag\u2019 Site Identity block attribute in all versions up to, and including, 3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Rise Blocks \u2013 A Complete Gutenberg Page Builder para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del atributo de bloque de identidad del sitio 'logoTag' en todas las versiones hasta la 3.7, inclusive, debido a una sanitizaci\u00f3n de entrada y escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1614", "lastModified": "2026-06-17T10:16:10.017", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1614", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T21:09:30.178596Z", "version": "2.0.3"}}]}, "published": "2026-02-25T07:16:01.197", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/rise-blocks/tags/3.7/classes/blocks/site-identity.php#L364"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/188f00f8-82f2-4166-9d6e-af996fe66422?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Rise Blocks \u2013 A Complete Gutenberg Page Builder", "source": "cna", "vendor": "eaglethemes"}, "product": "rise_blocks_\u2013_a_complete_gutenberg_page_builder", "vendor": "eaglethemes"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T23:55:58.293905+00:00", "value": {"mitigation_remediation": ["Update the Rise Blocks plugin to a version newer than 3.7 that removes the input sanitization flaw.", "Examine all Site Identity blocks on the site and remove or sanitize any embedded scripts found.", "If an update cannot be performed immediately, temporarily revoke Contributor-level access or limit contributors to view\u2011only permissions until the patch is applied."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All installations of Rise Blocks \u2013 A Complete Gutenberg Page Builder through version 3.7 are affected. Any WordPress site that has deployed the plugin in these versions is at risk, regardless of the source of installation.", "description_and_impact": "The Rise Blocks \u2013 A Complete Gutenberg Page Builder plugin for WordPress is vulnerable because the \u2018logoTag\u2019 Site Identity block attribute does not sanitize input or escape output, allowing an authenticated user with Contributor level access or higher to store arbitrary JavaScript. Once the script is stored, it executes in the browsers of any visitor who loads the affected page, enabling theft of session cookies, phishing, or loading of malicious resources.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1\u202f% suggests a low but non\u2011zero likelihood of exploitation. Because an attacker needs authenticated Contributor access, the vulnerability is not remote, but the stored script poses an ongoing risk to all page viewers once injected. The vulnerability is not listed in CISA's KEV catalog, reinforcing the low exploitation probability at present."}}}}, "created": "2026-02-26T13:18:27.052603+00:00", "updated": "2026-04-16T00:00:14.155734+00:00", "vendors": ["eaglethemes", "eaglethemes$PRODUCT$rise_blocks_\u2013_a_complete_gutenberg_page_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}