CVE-2026-108168

MediumCVSS 6.5

Published: 12/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The Custom Query Blocks plugin for WordPress up to version 5.6.0 contains a stored XSS vulnerability in the post-type-archive-mapping function. The vulnerability is due to improper neutralization of input during web page generation.

Risk Assessment

An attacker can inject malicious scripts that will execute in users' browsers, potentially leading to session theft or account takeover.

Recommendation

It is recommended to update the Custom Query Blocks plugin to the latest version that includes a fix for the vulnerability.

Other vulnerabilities in Custom Query Blocks

CVE-2026-39575Medium
The Custom Query Blocks plugin for WordPress up to version 5.5.0 contains a DOM-based XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts in the DOM context.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS