CVE-2026-92396
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not…
- Risk score
- 41/100
- CVSS
- 6.8 v3.1
- Published
- 6 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as con…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.4.4 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
Original description
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.
Last activity 6 Nov 2026. Patch Forecast updates every hour.