{"id":"CVE-2026-125451","kind":"vulnerability","aliases":["CVE-2026-125451"],"related":[],"title":"bPlugins B Blocks WordPress plugin: stored XSS through input handling","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.15.","summary":"The bPlugins B Blocks plugin for WordPress fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can submit content can run scripts in the browsers of people who view the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["b-blocks","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed B Blocks plugin version in the WordPress admin under Plugins, or with `wp plugin get b-blocks --field=version`\n- Compare the version against the range `2.1.15` and below, which the description says is affected","fix":"- B Blocks: unknown (the sources give no fixed version)","status":"open","published_at":"2026-11-11T12:19:49+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","triaged_at":"2026-11-11T12:28:32+00:00","updated_at":"2026-11-11T12:28:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T12:28:32Z","model":"claude-haiku-5-5","output":{"fix":"- B Blocks: unknown (the sources give no fixed version)","reach":"internet","title":"bPlugins B Blocks WordPress plugin: stored XSS through input handling","impact":"medium","summary":"The bPlugins B Blocks plugin for WordPress fails to neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can submit content can run scripts in the browsers of people who view the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","b-blocks","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in victims' browsers, possibly stealing admin sessions","analyst_note":"Find the fixed version of B Blocks from the WordPress plugin page or the vendor advisory, and confirm which user role can submit the stored content.","how_to_check":"- Check the installed B Blocks plugin version in the WordPress admin under Plugins, or with `wp plugin get b-blocks --field=version`\n- Compare the version against the range `2.1.15` and below, which the description says is affected","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the B Blocks WordPress plugin at version 2.1.15 or earlier are affected. The flaw is stored, so exposure depends on whether users with lower privileges can submit content that other visitors or admins later view; the sources do not say which roles are required.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000738,"input_tokens":4544,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125451':13A,16A '-2026':12A,15A '2.1.15':95C 'affect':63B,89C 'allow':85C 'attack':47B 'b':2A,18B,27B,80C,83C,90C 'b-block':17B,82C 'block':3A,19B,28B,81C,84C,91C 'bplugin':1A,26B,79C 'browser':57B 'content':51B 'cross':43B,74C 'cross-sit':42B,73C 'cve':11A,14A 'enabl':40B 'fail':32B 'generat':37B,72C 'handl':10A 'host':23B 'improp':65C 'input':9A,35B,68C 'issu':88C 'n/a':93C 'neutral':34B,66C 'packag':20B 'page':39B,64B,71C 'peopl':59B 'plugin':5A,29B 'run':53B 'script':45B,54B,76C 'self':22B 'self-host':21B 'site':44B,75C 'store':6A,41B,86C 'submit':50B 'view':61B 'vulner':77C 'web':38B,70C 'wordpress':4A,24B,31B 'xss':7A 'xss.this':87C","nicknames":[],"mitigations":[],"who_affected":"Sites running the B Blocks WordPress plugin at version 2.1.15 or earlier are affected. The flaw is stored, so exposure depends on whether users with lower privileges can submit content that other visitors or admins later view; the sources do not say which roles are required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bblocks","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-125451':13A,16A '-2026':12A,15A 'b':2A 'block':3A 'bplugin':1A 'cve':11A,14A 'handl':10A 'input':9A 'plugin':5A 'store':6A 'wordpress':4A 'xss':7A","search_b":"'affect':63B 'attack':47B 'b':18B,27B 'b-block':17B 'block':19B,28B 'bplugin':26B 'browser':57B 'content':51B 'cross':43B 'cross-sit':42B 'enabl':40B 'fail':32B 'generat':37B 'host':23B 'input':35B 'neutral':34B 'packag':20B 'page':39B,64B 'peopl':59B 'plugin':29B 'run':53B 'script':45B,54B 'self':22B 'self-host':21B 'site':44B 'store':41B 'submit':50B 'view':61B 'web':38B 'wordpress':24B,31B","search_c":"'2.1.15':95C 'affect':89C 'allow':85C 'b':80C,83C,90C 'b-block':82C 'block':81C,84C,91C 'bplugin':79C 'cross':74C 'cross-sit':73C 'generat':72C 'improp':65C 'input':68C 'issu':88C 'n/a':93C 'neutral':66C 'page':71C 'script':76C 'site':75C 'store':86C 'vulner':77C 'web':70C 'xss.this':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125451","severity":null,"published_at":"2026-11-11T12:19:49+00:00","modified_at":"2026-11-11T12:19:49+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","fetched_at":"2026-11-11T12:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}