https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 04:43:22 +0000 https://cve.radiocsirt.org/vuln/cnvd-2026-23810 cnvd-2026-23810 https://cve.radiocsirt.org/vuln/cnvd-2026-23810 https://cve.radiocsirt.org/vuln/euvd-2026-325752 EUVD-2026-325752 https://cve.radiocsirt.org/vuln/euvd-2026-325752 https://cve.radiocsirt.org/vuln/fkie_cve-2026-8981 <p>The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.</p> <p>The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-8981 https://cve.radiocsirt.org/vuln/ghsa-cfcv-65jq-76jw <p>The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.</p> <p>The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.</p> https://cve.radiocsirt.org/vuln/ghsa-cfcv-65jq-76jw