CVE-2026-17011
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Nexter Blocks WordPress plugin before version 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.
Risk Assessment
The risk includes the possibility of defacing the website, hiding content, or performing UI redressing attacks by users with low privileges, which may harm reputation and user trust.
Recommendation
It is recommended to immediately update the Nexter Blocks plugin to version 5.0.2 or later, which includes the security fix.
Original NVD description (English source)
The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.