CVE-2026-92396 · Package
NO FIX YET · SEE WHAT TO DO
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon before 2.4.4 lets a contributor-level WordPress user modify any post through an AJAX action without ownership checks. The stored value is not escaped in a JavaScript context, so injected scripts run when a higher-privileged user edits that post.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the ShopEngine Gutenberg WooCommerce Builder Blocks Addon before 2.4.4 are exposed. The attacker needs a contributor-level or higher account, and the script runs when a higher-privileged user edits the affected post. Sites where the plugin is not installed, or where no untrusted users can create contributor accounts, are less exposed.
Not affected if no-untrusted-contributors, plugin-not-installed
Who cares shopengine, woocommerce, wordpress
wp plugin get shopengine --field=version2.4.4 or laterThe ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.