https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T04:43:23.617070+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2026-23810 cnvd-2026-23810 2026-10-12T04:43:23.622954+00:00 cnvd-2026-23810 https://cve.radiocsirt.org/vuln/euvd-2026-325752 EUVD-2026-325752 2026-10-12T04:43:23.622985+00:00 EUVD-2026-325752 https://cve.radiocsirt.org/vuln/fkie_cve-2026-8981 fkie_cve-2026-8981 2026-10-12T04:43:23.623000+00:00

The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.

 https://cve.radiocsirt.org/vuln/ghsa-cfcv-65jq-76jw GHSA-cfcv-65jq-76jw 2026-10-12T04:43:23.623028+00:00

The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.