CVE-2026-88824

Summary

The flaw allows unauthenticated users to update settings in the Master Blocks WordPress plugin, leading to Stored XSS that can be executed in the session of any administrator visiting a wp-admin page.

Exploitability

Exploitation is relatively easy as it requires no authentication and can be performed by any unauthenticated user.

Blast radius

If exploited, the impact is high as it can lead to arbitrary JavaScript execution in the context of an administrator, potentially leading to full compromise of the admin session.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.5.0 or later of the Master Blocks WordPress plugin.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.