CVE-2026-75016
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping in the NewsTicker::render() method, which concatenates the clientId block attribute into an HTML class attribute without applying esc_attr().
Risk Assessment
An authenticated attacker with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page, potentially leading to session theft or other browser-based attacks.
Recommendation
Update the Magazine Blocks plugin to a version later than 1.8.6.
Other vulnerabilities in Magazine Blocks
See all- CVE-2026-75017Medium
The Magazine Blocks plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6 due to improper verification that a user is authorized to perform an action. An authenticated attacker with contributor-level access and above can demote administrator-owned published builder templates to draft status and replace them with attacker-authored block content rendered site-wide.
- CVE-2026-78290Medium
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
- CVE-2026-40728Medium
Missing Authorization vulnerability in BlockArt Magazine Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Magazine Blocks through version 1.8.3.
Original NVD description (English source)
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render() method, which concatenates the clientId block attribute into an HTML class attribute without applying esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS