CVE-2026-88824

Received Received - Intake

Stored XSS in Master Blocks WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: WPScan

Description

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-88824

Affected Vendors & Products

Vendor	Product	Version / Range
master_blocks	master_blocks	to 1.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Master Blocks WordPress plugin before version 1.5.0. An unauthenticated user can exploit a missing authorization check on a REST route to update plugin settings. One of these settings is output without proper escaping in the admin area, allowing malicious scripts to be stored and executed when an administrator visits a wp-admin page.

Detection Guidance

Check if the Master Blocks WordPress plugin version is below 1.5.0. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details. Look for unauthenticated access to the vulnerable REST route.

Impact Analysis

An attacker could inject malicious scripts into your WordPress site, potentially stealing sensitive admin session data, performing actions on your behalf, or taking control of your site. Administrators visiting the wp-admin area would unknowingly execute these scripts, leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized access to personal or health data. If exploited, it may result in data breaches, violating confidentiality requirements and triggering regulatory penalties or legal consequences.

Mitigation Strategies

Update the Master Blocks plugin to version 1.5.0 or higher immediately. If updating is not possible, disable the plugin until a patch is applied. Review and restrict access to WordPress admin pages.

Hi! I’m here to help you understand CVE-2026-88824. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70