CVE-2026-40804

HighCVSS 7.1

Published: 08/10/2026(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

3th percentile - higher than 3% of all known CVEs

Summary

Reflected Cross-site Scripting (XSS) vulnerability in the aBlocks plugin by Kodezen LLC. Improper input neutralization during web page generation allows an attacker to inject malicious scripts.

Risk Assessment

An attacker can steal user session data, take over accounts, or perform other malicious actions in the context of the victim's browser.

Recommendation

Update the aBlocks plugin to a version newer than 2.16.0 if a fix is available. Restrict access to the admin panel and filter input data.

Other vulnerabilities in aBlocks

CVE-2026-57386High
The aBlocks WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects plugin versions from n/a through 2.9.1.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS