CVE-2026-104400

MediumCVSS 6.5

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

Stored XSS vulnerability in B Blocks plugin up to version 2.1.8. Allows injection of a persistent script that can execute in the administrator's browser.

Risk Assessment

Risk of admin session hijacking, data theft, or website defacement.

Recommendation

Update the B Blocks plugin to a patched version.

Other vulnerabilities in B Blocks

CVE-2026-39579High
B Blocks versions up to 2.0.31 contain a vulnerability that allows contributor privilege escalation.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS