{"id":"CVE-2026-116400","kind":"vulnerability","aliases":["CVE-2026-116400"],"related":[],"title":"Button Block WordPress plugin: stored XSS through versions 1.2.7","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7.","summary":"The bPlugins Button Block plugin for WordPress does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store content in the plugin's block output can run scripts in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bplugins","package","self-hosted","wordpress"],"not_affected_if":["no-untrusted-contributors","plugin-not-installed"],"how_to_check":"- Check the installed version of the Button Block plugin (`button-block`) in the WordPress admin plugins list or `wp plugin get button-block --field=version`\n- Confirm whether any page or post uses the Button Block block","fix":"- Update Button Block (`button-block`) to a version later than `1.2.7`, once the vendor publishes a fixed release; the sources do not name it\n- Until fixed, deactivate the plugin or restrict contributor roles that can add blocks","status":"open","published_at":"2026-10-26T18:17:44+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","triaged_at":"2026-10-26T18:33:55+00:00","updated_at":"2026-10-26T18:33:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T18:33:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update Button Block (`button-block`) to a version later than `1.2.7`, once the vendor publishes a fixed release; the sources do not name it\n- Until fixed, deactivate the plugin or restrict contributor roles that can add blocks","reach":"internet","title":"Button Block WordPress plugin: stored XSS through versions 1.2.7","impact":"medium","summary":"The bPlugins Button Block plugin for WordPress does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can store content in the plugin's block output can run scripts in other users' browsers.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","bplugins"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker script runs in victims' browsers, hijacking admin sessions","analyst_note":"Confirm the fixed version and the required role to inject content from the NVD entry or the vendor advisory; the sources give only 'through 1.2.7'.","how_to_check":"- Check the installed version of the Button Block plugin (`button-block`) in the WordPress admin plugins list or `wp plugin get button-block --field=version`\n- Confirm whether any page or post uses the Button Block block","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-untrusted-contributors"],"who_is_affected":"Sites running the Button Block plugin version 1.2.7 or earlier, most of all sites where users with lower privileges can create or edit content that is later shown to visitors or admins. Sites that do not have the plugin installed can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000628,"input_tokens":3303,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116400':12A,15A '-2026':11A,14A '1.2.7':9A,92C 'affect':86C 'allow':82C 'attack':44B 'block':2A,25B,53B,78C,81C,88C 'bplugin':16B,23B,76C 'browser':61B 'button':1A,24B,77C,80C,87C 'button-block':79C 'content':48B 'cross':40B,71C 'cross-sit':39B,70C 'cve':10A,13A 'enabl':37B 'generat':34B,69C 'host':20B 'improp':62C 'input':32B,65C 'issu':85C 'n/a':90C 'neutral':31B,63C 'output':54B 'packag':17B 'page':36B,68C 'plugin':4A,26B,51B 'run':56B 'script':42B,57B,73C 'self':19B 'self-host':18B 'site':41B,72C 'store':5A,38B,47B,83C 'user':60B 'version':8A 'vulner':74C 'web':35B,67C 'wordpress':3A,21B,28B 'xss':6A 'xss.this':84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Button Block plugin version 1.2.7 or earlier, most of all sites where users with lower privileges can create or edit content that is later shown to visitors or admins. Sites that do not have the plugin installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116400","severity":null,"published_at":"2026-10-26T18:17:44+00:00","modified_at":"2026-10-26T18:17:44+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","fetched_at":"2026-10-26T18:31:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}