{"id":"CVE-2026-110290","kind":"vulnerability","aliases":["CVE-2026-110290"],"related":[],"title":"WebberZone Top 10 WordPress plugin: stored XSS through block attributes","description":"The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject instance_id) + undeclared is_widget' parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires setting the undeclared is_widget flag to '1' via block JSON, which activates the vulnerable code path that concatenates the attacker-controlled instance_id value into an unescaped HTML class attribute.","summary":"The WebberZone Top 10 Popular Posts plugin for WordPress up to and including 4.5.2 does not sanitize the instance_id attribute it writes into an HTML class, so the attribute can carry script. An attacker with contributor-level access can store a script in a page that runs in the browser of any user who opens it.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-untrusted-contributors","plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed version of the WebberZone Top 10 plugin in the WordPress admin plugin list or with `wp plugin get top-10 --field=version`\n- Review pages and posts for Top 10 blocks with unexpected script content in their block attributes","fix":"- Update the WebberZone Top 10 plugin to a version later than `4.5.2` (the sources do not name the fixed release)","status":"open","published_at":"2026-10-16T07:17:11+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:59:50+00:00","updated_at":"2026-10-25T03:59:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:59:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the WebberZone Top 10 plugin to a version later than `4.5.2` (the sources do not name the fixed release)","reach":"internet","title":"WebberZone Top 10 WordPress plugin: stored XSS through block attributes","impact":"medium","summary":"The WebberZone Top 10 Popular Posts plugin for WordPress up to and including 4.5.2 does not sanitize the instance_id attribute it writes into an HTML class, so the attribute can carry script. An attacker with contributor-level access can store a script in a page that runs in the browser of any user who opens it.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Scripts run in visitors' browsers, stealing sessions or acting as the user","analyst_note":"Find the fixed version of WebberZone Top 10 after 4.5.2 at the NVD entry or the plugin changelog to fill in the fix and version check.","how_to_check":"- Check the installed version of the WebberZone Top 10 plugin in the WordPress admin plugin list or with `wp plugin get top-10 --field=version`\n- Review pages and posts for Top 10 blocks with unexpected script content in their block attributes","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated","no-untrusted-contributors"],"who_is_affected":"Sites running the WebberZone Top 10 plugin at version 4.5.2 or earlier that have contributor-level or higher accounts able to create or edit pages with its blocks. Sites without the plugin, or with the plugin on a later version, are not affected. Sites where only administrators write content have a smaller exposure.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3472,"output_tokens":643,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110290':13A,16A '-2026':12A,15A '1':169C '10':3A,28B,85C '4.5.2':38B,119C 'access':64B,139C,155C 'activ':174C 'arbitrari':144C 'attack':59B,134C,183C 'attacker-control':182C 'attribut':10A,45B,54B,102C,193C 'authent':133C 'block':9A,171C 'browser':76B 'carri':56B 'class':51B,192C 'code':177C 'concaten':180C 'contributor':62B,137C 'contributor-level':61B,136C 'control':184C 'cross':96C 'cross-sit':95C 'cve':11A,14A 'due':120C 'escap':127C 'execut':151C 'exploit':160C 'flag':167C 'host':20B 'html':50B,191C 'id':44B,107C,186C 'includ':37B,118C 'inject':105C,143C,157C 'input':123C 'instanc':43B,106C,185C 'insuffici':122C 'json':172C 'level':63B,138C 'make':129C 'open':81B 'output':126C 'packag':17B 'page':71B,148C,158C 'paramet':111C 'pars':103C 'path':178C 'plugin':5A,24B,31B,88C 'popular':29B,86C 'possibl':131C 'post':30B,87C 'requir':161C 'run':73B 'sanit':41B,124C 'script':57B,68B,98C,146C 'self':19B 'self-host':18B 'set':162C 'site':97C 'store':6A,66B,94C 'top':2A,27B,84C 'undeclar':108C,164C 'unescap':190C 'user':79B,154C 'valu':187C 'version':114C 'via':99C,170C 'vulner':92C,176C 'web':145C 'webberzon':1A,26B,83C 'whenev':152C 'widget':110C,166C 'wordpress':4A,21B,23B,33B,90C 'wordpress-plugin':22B 'write':47B 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running the WebberZone Top 10 plugin at version 4.5.2 or earlier that have contributor-level or higher accounts able to create or edit pages with its blocks. Sites without the plugin, or with the plugin on a later version, are not affected. Sites where only administrators write content have a smaller exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110290","severity":null,"published_at":"2026-10-16T07:17:11+00:00","modified_at":"2026-10-16T15:17:10+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}