{"id":"CVE-2026-61993","kind":"vulnerability","aliases":["CVE-2026-61993"],"related":[],"title":"Blockonomics plugin: unauthenticated cross-site scripting in version 3.11.0","description":"Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.","summary":"Blockonomics 3.11.0 has an unauthenticated cross-site scripting flaw. An attacker can inject script that runs in a visitor's or administrator's browser.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"blockonomics-bitcoin-payments","fixed":[],"affected":"3.11.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["blockonomics","package","unauthenticated","woocommerce","wordpress","xss"],"not_affected_if":["other-plugin-versions","plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, look for 'Bitcoin Payments – Blockonomics' (slug blockonomics-bitcoin-payments); version 3.11.0 is affected. Or run: wp plugin get blockonomics-bitcoin-payments --field=version","fix":"No patched version as of 2026-10-29: the wordpress.org changelog lists 3.11.0 as the latest release and Patchstack says no official patch is available. Watch for a release above 3.11.0; until then consider deactivating the plugin or applying a WAF/virtual patch.","status":"open","published_at":"2026-10-29T16:18:12+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:29:54+00:00","updated_at":"2026-10-29T16:36:02+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:29:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Blockonomics plugin: unauthenticated cross-site scripting in version 3.11.0","impact":"medium","summary":"Blockonomics 3.11.0 has an unauthenticated cross-site scripting flaw. An attacker can inject script that runs in a visitor's or administrator's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","blockonomics","woocommerce"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in visitors' browsers and may steal sessions","analyst_note":"Find the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-61993) and the vendor's changelog to confirm the fixed version and vulnerable endpoint.","how_to_check":"- Check the installed Blockonomics plugin version in the WordPress plugin list or the plugin's main file header.\n- unknown for further checks: the sources do not say which pages or settings are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["other-plugin-versions"],"who_is_affected":"Sites running the Blockonomics plugin at version 3.11.0. The sources do not describe the exact page or input that is vulnerable, so whether a given site is reachable is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00066,"input_tokens":4062,"output_tokens":508,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-61993) and the vendor's changelog to confirm the fixed version and vulnerable endpoint.","search":"'-2026':12A,15A '-61993':13A,16A '3.11.0':10A,28B,59C 'administr':49B 'attack':38B 'bitcoin':19A 'blockonom':1A,21B,27B,58C 'blockonomics':18A 'blockonomics-bitcoin-payments':17A 'browser':51B 'cross':5A,33B,53C 'cross-sit':4A,32B 'cve':11A,14A 'flaw':36B 'inject':40B 'packag':22B 'payments':20A 'plugin':2A 'run':43B 'script':7A,35B,41B,55C 'site':6A,34B,54C 'unauthent':3A,23B,31B,52C 'version':9A,60C 'visitor':46B 'woocommerc':24B 'wordpress':25B 'xss':26B,56C","nicknames":[],"mitigations":[],"who_affected":"WordPress/WooCommerce stores running the Bitcoin Payments – Blockonomics plugin at exactly version 3.11.0. An unauthenticated attacker can get script to run in a visitor's or admin's browser, but it needs the victim to click a crafted link or visit a crafted page. Sites without this plugin, or on other versions, can skip it. The exact vulnerable endpoint is not published.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61993","severity":null,"published_at":"2026-10-29T16:18:12+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-61993:1070","url":null,"severity":null,"published_at":"2026-10-29T16:35:58+00:00","modified_at":"2026-10-29T16:36:02+00:00","first_seen_at":"2026-10-29T16:35:58+00:00","fetched_at":"2026-10-29T16:36:02+00:00","note":"Correction: the earlier write wrongly marked who_affected verified. Only the third-party Patchstack page describes the affected version, and the vendor page has no advisory. The badge is removed and nothing is verified."}],"documents":[{"id":17787,"url":"https://patchstack.com/database/wordpress/plugin/blockonomics-bitcoin-payments/vulnerability/wordpress-blockonomics-plugin-3-11-0-cross-site-scripting-xss-vulnerability","title":"Patchstack: Blockonomics 3.11.0 XSS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17788,"url":"https://wordpress.org/plugins/blockonomics-bitcoin-payments/","title":"Bitcoin Payments – Blockonomics (wordpress.org changelog, latest 3.11.0)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}