CVE-2026-78290
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
Risk Assessment
An attacker with contributor privileges can inject malicious scripts that execute in other users' browsers, potentially leading to session theft or other malicious actions.
Recommendation
Update the Magazine Blocks plugin to a patched version and restrict contributor privileges.
Other vulnerabilities in Magazine Blocks
See all- CVE-2026-75017Medium
The Magazine Blocks plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6 due to improper verification that a user is authorized to perform an action. An authenticated attacker with contributor-level access and above can demote administrator-owned published builder templates to draft status and replace them with attacker-authored block content rendered site-wide.
- CVE-2026-75016Medium
The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6 due to insufficient input sanitization and output escaping in the NewsTicker::render() method, which concatenates the clientId block attribute into an HTML class attribute without applying esc_attr().
- CVE-2026-40728Medium
Missing Authorization vulnerability in BlockArt Magazine Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Magazine Blocks through version 1.8.3.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS