Stored cross-site scripting in ShopEngine Blocks Addon for WordPress
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not check user capabilities or post ownership in an AJAX action, and does not escape a stored value before outputting it in a JavaScript context. The weakness is classified as CWE-79. A user with a contributor role or higher can inject arbitrary scripts into any post, and those scripts run when a higher privileged user edits that post. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | ShopEngine Gutenberg WooCommerce Builder Blocks Addon | before 2.4.4 | 2.4.4 | Patch available | CNA |
- ShopEngine Gutenberg WooCommerce Builder Blocks Addon VendorUnknown Affected before 2.4.4 Fixed in 2.4.4 Patch available CNA
Remediation
Update the ShopEngine Gutenberg WooCommerce Builder Blocks Addon plugin to version 2.4.4, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA ShopEngine Gutenberg WooCommerce Builder Blocks Addon (Unknown) Fixed in 2.4.4
Timeline
- 2026-11-06 Threatist record created from CVE-2026-92396
- 2026-11-06 Alias added: GHSA-prx4-2899-p4c2
- 2026-11-06 CVSS score added · CISA ADP
- 2026-11-06 Weakness changed · CISA ADP
- 2026-11-06 CISA SSVC decision points changed
References
Sources
- CVE-2026-92396 · CVE Program
- CVE-2026-92396 · NVD
- FIRST EPSS
- GHSA-prx4-2899-p4c2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences