Live › vulnerability › CVE-2026-116400
Go to dashboardThe bPlugins Button Block plugin for WordPress does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store content in the plugin's block output can run scripts in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Sites running the Button Block plugin version 1.2.7 or earlier, most of all sites where users with lower privileges can create or edit content that is later shown to visitors or admins. Sites that do not have the plugin installed can skip it.
No product ranges from the sources yet.
button-block) in the WordPress admin plugins list or wp plugin get button-block --field=versionbutton-block) to a version later than 1.2.7, once the vendor publishes a fixed release; the sources do not name itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-116400")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.