{"id":"CVE-2026-115955","kind":"vulnerability","aliases":["CVE-2026-115955"],"related":[],"title":"WordPress Advanced Post Block plugin: stored XSS via post grid block","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced Post Block - Post Grid for WordPress block editor advanced-post-block allows Stored XSS.This issue affects Advanced Post Block - Post Grid for WordPress block editor: from n/a through 2.5.1.","summary":"The Advanced Post Block - Post Grid plugin for the WordPress block editor does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store content that the plugin renders can run JavaScript in the browsers of visitors or editors.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get advanced-post-block --field=version`\n- Confirm whether the site uses the Advanced Post Block post grid block on pages or posts","fix":"- Update Advanced Post Block - Post Grid to a version later than `2.5.1`\n- unknown: the sources do not name the first fixed version","status":"open","published_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","triaged_at":"2026-10-26T11:31:04+00:00","updated_at":"2026-10-26T11:31:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T11:31:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update Advanced Post Block - Post Grid to a version later than `2.5.1`\n- unknown: the sources do not name the first fixed version","reach":"internet","title":"WordPress Advanced Post Block plugin: stored XSS via post grid block","impact":"medium","summary":"The Advanced Post Block - Post Grid plugin for the WordPress block editor does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store content that the plugin renders can run JavaScript in the browsers of visitors or editors.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers and admins' sessions","analyst_note":"Find the fixed version and required privilege level from the bPlugins advisory or the WordPress plugin changelog; the NVD entry gives no fix version.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get advanced-post-block --field=version`\n- Confirm whether the site uses the Advanced Post Block post grid block on pages or posts","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the advanced-post-block WordPress plugin at version 2.5.1 or earlier, where the post grid block is used to display content. The sources do not say which user roles can store the input, so the exact exposure path is unknown. Sites without this plugin installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3343,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115955':14A,17A '-2026':13A,16A '2.5.1':114C 'advanc':2A,24B,84C,94C,102C 'advanced-post-block':93C 'affect':101C 'allow':97C 'attack':50B 'block':4A,11A,26B,33B,86C,91C,96C,104C,109C 'bplugin':83C 'browser':64B 'content':54B 'cross':46B,78C 'cross-sit':45B,77C 'cve':12A,15A 'editor':34B,68B,92C,110C 'enabl':43B 'generat':40B,76C 'grid':10A,28B,88C,106C 'improp':69C 'input':38B,72C 'issu':100C 'javascript':61B 'n/a':112C 'neutral':37B,70C 'packag':18B 'page':42B,75C 'plugin':5A,22B,29B,57B 'post':3A,9A,25B,27B,85C,87C,95C,103C,105C 'render':58B 'run':60B 'script':48B,80C 'site':47B,79C 'store':6A,44B,53B,98C 'via':8A 'visitor':66B 'vulner':81C 'web':41B,74C 'wordpress':1A,19B,21B,32B,90C,108C 'wordpress-plugin':20B 'xss':7A 'xss.this':99C","nicknames":[],"mitigations":[],"who_affected":"Sites running the advanced-post-block WordPress plugin at version 2.5.1 or earlier, where the post grid block is used to display content. The sources do not say which user roles can store the input, so the exact exposure path is unknown. Sites without this plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115955","severity":null,"published_at":"2026-10-26T11:16:36+00:00","modified_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","fetched_at":"2026-10-26T11:29:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}