CVE-2026-94118
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in the Premium Blocks – Gutenberg Blocks for WordPress plugin in versions up to and including 2.3.17. The vulnerability can be exploited by a user with Contributor privileges.
Risk Assessment
A user with Contributor privileges can inject malicious script that executes in other users' browsers, including administrators. This may lead to session theft or account takeover.
Recommendation
Update the Premium Blocks – Gutenberg Blocks for WordPress plugin to a version newer than 2.3.17. Verify no other vulnerable plugins exist and limit the number of Contributor accounts.
Other vulnerabilities in Premium Blocks – Gutenberg Blocks for WordPress
See all- CVE-2026-123474Medium
The Premium Blocks – Gutenberg Blocks for WordPress plugin (through version 2.3.18) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-123466Medium
The Premium Blocks – Gutenberg Blocks for WordPress plugin (up to version 2.3.18) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS