CVE-2026-97315

Deferred Deferred - Pending Action

HTML Injection in Responsive Blocks WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-97315

EUVD

EUVD-2026-100978

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Responsive	Blocks 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated HTML injection flaw in the Responsive Blocks WordPress plugin before version 2.3.0. It occurs in the Form block feature where user-submitted values are not properly sanitized or escaped before being included in HTML notification emails sent to the site owner. Attackers can inject arbitrary HTML, such as phishing links, into these emails without authentication.

Detection Guidance

Check if the Responsive Blocks WordPress plugin version is below 2.3.0 by inspecting the plugin files or WordPress admin panel. Look for suspicious HTML content in notification emails sent to the site owner, especially those containing unexpected links or scripts.

Impact Analysis

This vulnerability allows unauthenticated attackers to inject malicious HTML into emails sent to the site owner. This could lead to phishing attacks, where users receive deceptive links or content that appears legitimate but steals sensitive information. It may also compromise the trust in the website or brand.

Compliance Impact

This vulnerability could lead to data breaches or phishing attacks, which may violate GDPR or HIPAA requirements for protecting user data and maintaining secure communications. Non-compliance with these regulations can result in legal penalties and reputational damage.

Mitigation Strategies

Update the Responsive Blocks plugin to version 2.3.0 or later immediately. If updating is not possible, disable the plugin until an update is applied. Review recent notification emails for any injected HTML content and remove suspicious entries.

Hi! I’m here to help you understand CVE-2026-97315. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70