CVE-2026-111843

MediumCVSS 6.5

Published: 20/10/2026(UTC)Updated: 21/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Summary

The WordPress Rootblox plugin through 1.0.7 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This may allow injection of a malicious script that is stored and executed by other users.

Risk Assessment

An attacker can execute arbitrary JavaScript in the browsers of users visiting the site, potentially leading to session or data theft. The risk affects WordPress sites with the vulnerable Rootblox version installed.

Recommendation

Update the Rootblox plugin to the latest version (above 1.0.7). Consider deploying a WAF and regularly scanning for XSS.

Other vulnerabilities in Rootblox

CVE-2026-112832Critical
The CozyThemes Rootblox WordPress plugin through version 1.0.6 contains an Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability that allows PHP Local File Inclusion.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS