CVE-2026-6551

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6551", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-04-17T21:23:28.358Z", "datePublished": "2026-04-28T04:28:20.578Z", "dateUpdated": "2026-04-28T14:34:04.680Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-28T04:28:20.578Z"}, "affected": [{"vendor": "techeshta", "product": "Timeline Blocks for Gutenberg", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Timeline Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute of the timeline-blocks/tb-timeline-blocks block in all versions up to, and including, 1.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Timeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/393d1b30-19f8-454d-84c0-0b539953e1fe?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/tags/1.1.10/src/blocks/index.php#L202"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/tags/1.1.10/src/blocks/index.php#L343"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L202"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L343"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L200"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L342"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2026-04-18T07:12:43.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-27T15:59:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-28T14:05:40.179008Z", "id": "CVE-2026-6551", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:34:04.680Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6551", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-28T14:05:40.179008Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:05:47.622Z"}}], "cna": {"title": "Timeline Blocks for Gutenberg <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "techeshta", "product": "Timeline Blocks for Gutenberg", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-18T07:12:43.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-27T15:59:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/393d1b30-19f8-454d-84c0-0b539953e1fe?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/tags/1.1.10/src/blocks/index.php#L202"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/tags/1.1.10/src/blocks/index.php#L343"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L202"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L343"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L200"}, {"url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L342"}], "descriptions": [{"lang": "en", "value": "The Timeline Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute of the timeline-blocks/tb-timeline-blocks block in all versions up to, and including, 1.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-28T04:28:20.578Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6551", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:34:04.680Z", "dateReserved": "2026-04-17T21:23:28.358Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-28T04:28:20.578Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Timeline Blocks for Gutenberg", "vendor": "techeshta", "versions": [{"lessThanOrEqual": "1.1.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Timeline Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute of the timeline-blocks/tb-timeline-blocks block in all versions up to, and including, 1.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-6551", "lastModified": "2026-06-17T11:00:57.933", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6551", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-28T14:05:40.179008Z", "version": "2.0.3"}}]}, "published": "2026-04-28T06:16:04.417", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/tags/1.1.10/src/blocks/index.php#L202"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/tags/1.1.10/src/blocks/index.php#L343"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L200"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L202"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L342"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/timeline-blocks/trunk/src/blocks/index.php#L343"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/393d1b30-19f8-454d-84c0-0b539953e1fe?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.10]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Timeline Blocks for Gutenberg", "source": "cna", "vendor": "techeshta"}, "product": "timeline_blocks_for_gutenberg", "vendor": "techeshta"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-28T19:30:40.593072+00:00", "value": {"mitigation_remediation": ["Upgrade the Timeline Blocks for Gutenberg plugin to the latest released version that addresses the 'titleTag' sanitization issue.", "If an upgrade is not immediately possible, revoke Contributor role access to the block editor or remove the plugin entirely from the site to prevent exploitation.", "As a temporary measure, restrict the use of Timeline Blocks by limiting block insertion to Administrators only and audit existing content for unexpected JavaScript in the 'titleTag' attribute."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting allowing arbitrary script execution when a page is viewed"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Timeline Blocks for Gutenberg plugin, any version up to and including 1.1.10.", "description_and_impact": "The Timeline Blocks for Gutenberg plugin is vulnerable to stored Cross\u2011Site Scripting due to the lack of proper input sanitization and output escaping on the 'titleTag' block attribute. An attacker who can authenticate with contributor or higher privileges can inject malicious JavaScript into the attribute, which is then persisted in the database. When any user loads a page containing the injected block, the script executes in the context of the page, permitting attacks such as defacement, cookie theft, or other client\u2011side compromise.", "risk_and_exploitability": "With a CVSS score of 6.4 the vulnerability represents a moderate severity risk. No EPSS data is available, and the vulnerability is not listed in CISA\u2019s KEV catalog, but the attack vector remains clear: an authenticated contributor or higher user can insert malicious payloads. The stored nature of the flaw means the impact is permanent until the page is regenerated or the payload removed, potentially affecting all visitors to the affected posts."}}}}, "created": "2026-04-28T09:16:20.248728+00:00", "updated": "2026-04-28T19:45:07.574870+00:00", "vendors": ["techeshta", "techeshta$PRODUCT$timeline_blocks_for_gutenberg", "wordpress", "wordpress$PRODUCT$wordpress"]}