CVE-2026-8981
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Vulnerability in Custom Block Builder WordPress plugin before 4.3.0 allows administrators on multisite (or with DISALLOW_UNFILTERED_HTML) to inject arbitrary JavaScript that executes for visitors of pages with the affected block.
Risk Assessment
The risk involves injection of malicious scripts that can steal data or hijack user sessions.
Recommendation
Update the Custom Block Builder plugin to version 4.3.0 or later.
Original NVD description (English source)
The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.