---
id: "CVE-2026-118800"
page: "https://infrastack.ai/live/CVE-2026-118800"
kind: "vulnerability"
aliases: ["CVE-2026-118800"]
title: "aBlocks WordPress plugin: stored script injection via headingTag parameter"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ablocks", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-contributor-accounts", "plugin-not-installed"]
published_at: "2026-11-07T07:17:03+00:00"
first_seen_at: "2026-11-07T07:46:07+00:00"
updated_at: "2026-11-07T07:47:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118800", "first_seen_at": "2026-11-07T07:46:07+00:00"}]
exploit_sources: []
---

# aBlocks WordPress plugin: stored script injection via headingTag parameter

Link for people: https://infrastack.ai/live/CVE-2026-118800 (this .md is for agents)

The aBlocks WordPress plugin does not sanitize the headingTag parameter, so a logged-in contributor can save a page that runs scripts. The script then executes in the browser of any visitor who opens that page, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the aBlocks plugin is installed and its version in the WordPress admin under Plugins
- Compare the installed version against `2.18.0`; versions up to and including `2.18.0` are affected

## Timeline

- 2026-11-07T07:46:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118800

## From the sources

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingTag' parameter in all versions up to, and including, 2.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_