Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2026-88993: All Bootstrap Blocks lets contributors add malicious scripts
CVE-2026-88993 · published 1 month ago
Summary
The All Bootstrap Blocks plugin for WordPress, up to version 1.3.31, fails to clean a button attribute properly. This lets users with contributor or higher permissions insert custom code that runs whenever the page is viewed. Update the plugin to the latest version or limit contributor privileges to prevent this.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | all bootstrap blocks | <= 1.3.31 |
Original advisory text
All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
6.8
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published18 Sep 2026
Updated4 Nov 2026
First seen18 Sep 2026
Track software like this
Free during beta