CVE-2026-1646

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1646", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-29T18:41:12.628Z", "datePublished": "2026-02-19T04:36:08.200Z", "dateUpdated": "2026-04-08T16:45:15.753Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:15.753Z"}, "affected": [{"vendor": "iamjaydip", "product": "Advance Block Extend", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attribute in the Latest Posts Gutenberg block in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Advance Block Extend <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3218716a-cce6-4ce7-a6be-4e146e0a6d53?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/advance-block-extend/trunk/gutenberg-block.php#L118"}, {"url": "https://plugins.trac.wordpress.org/browser/advance-block-extend/tags/1.0.4/gutenberg-block.php#L118"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}, {"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}, {"lang": "en", "type": "finder", "value": "Vilaysone CHANTHAVONG"}], "timeline": [{"time": "2026-02-18T15:53:05.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:03:57.336064Z", "id": "CVE-2026-1646", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:38:57.467Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1646", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:03:57.336064Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:03:58.859Z"}}], "cna": {"title": "Advance Block Extend <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}, {"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}, {"lang": "en", "type": "finder", "value": "Vilaysone CHANTHAVONG"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "iamjaydip", "product": "Advance Block Extend", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T15:53:05.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3218716a-cce6-4ce7-a6be-4e146e0a6d53?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/advance-block-extend/trunk/gutenberg-block.php#L118"}, {"url": "https://plugins.trac.wordpress.org/browser/advance-block-extend/tags/1.0.4/gutenberg-block.php#L118"}], "descriptions": [{"lang": "en", "value": "The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attribute in the Latest Posts Gutenberg block in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:45:15.753Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1646", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:45:15.753Z", "dateReserved": "2026-01-29T18:41:12.628Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:08.200Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Advance Block Extend", "vendor": "iamjaydip", "versions": [{"lessThanOrEqual": "1.0.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attribute in the Latest Posts Gutenberg block in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Advance Block Extend para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del atributo de bloque TitleColor en el bloque Gutenberg Latest Posts en todas las versiones hasta la 1.0.4, inclusive, debido a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida. Esto permite a atacantes autenticados, con acceso de nivel Colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-1646", "lastModified": "2026-06-17T10:16:14.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1646", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T17:03:57.336064Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:44.233", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/advance-block-extend/tags/1.0.4/gutenberg-block.php#L118"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/advance-block-extend/trunk/gutenberg-block.php#L118"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3218716a-cce6-4ce7-a6be-4e146e0a6d53?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Advance Block Extend", "source": "cna", "vendor": "iamjaydip"}, "product": "advance_block_extend", "vendor": "iamjaydip"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:12:43.931699+00:00", "value": {"mitigation_remediation": ["Upgrade the Advance Block Extend plugin to version 1.0.5 or later, which removes the vulnerable TitleColor attribute handling.", "If upgrading is not feasible, add a server\u2011side filter that strips or sanitizes the TitleColor attribute from the Latest Posts block to prevent script injection.", "Reduce the risk of exploitation by limiting Contributor privileges so they cannot edit block attributes, or temporarily remove Contributor users from the site until the vulnerability is resolved."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Advance Block Extend plugin distributed by iamjaydip, known as the Advance Block Extend plugin, for all WordPress installations that have versions up to and including 1.0.4. Any WordPress site that has installed this plugin and has users with Contributor or higher roles is susceptible. No other products or versions are impacted according to the vendor information.", "description_and_impact": "The Advance Block Extend plugin for WordPress is vulnerable to stored cross\u2011site scripting through the TitleColor attribute of the Latest Posts Gutenberg block. Because the plugin does not sanitize or escape this attribute, an authenticated user with Contributor level or higher can inject arbitrary JavaScript. When an affected user loads a page containing the injected block, the malicious script runs in the visitor's browser, enabling cookie theft, phishing, or other client\u2011side attacks. This flaw represents a classic injection weakness (CWE\u201179).", "risk_and_exploitability": "The CVSS v3 base score of 6.4 classifies this flaw as medium severity, but the EPSS score of less than 1% indicates a very low probability of widespread exploitation at present. Because the flaw requires authenticated Contributor or admin access, attackers must first compromise legitimate credentials or obtain a high\u2011privilege role. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited active exploitation. Nonetheless, once a site owner authorizes a contributor, they could inject payloads that run for every visitor to the site, potentially affecting large traffic volumes. The necessary access level and lack of an immediate public exploit keep the risk moderate but non\u2011negligible for active WordPress sites relying on this plugin."}}}}, "created": "2026-02-19T10:07:20.960725+00:00", "updated": "2026-04-15T18:15:10.855336+00:00", "vendors": ["iamjaydip", "iamjaydip$PRODUCT$advance_block_extend", "wordpress", "wordpress$PRODUCT$wordpress"]}