{"id":"CVE-2026-92396","kind":"vulnerability","aliases":["CVE-2026-92396"],"related":[],"title":"ShopEngine WordPress plugin: contributors can inject scripts that run for editors","description":"The ShopEngine Gutenberg WooCommerce Builder Blocks Addon  WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.","summary":"The ShopEngine Gutenberg WooCommerce Builder Blocks Addon before 2.4.4 lets a contributor-level WordPress user modify any post through an AJAX action without ownership checks. The stored value is not escaped in a JavaScript context, so injected scripts run when a higher-privileged user edits that post.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","shopengine","woocommerce","wordpress"],"not_affected_if":["no-untrusted-contributors","plugin-not-installed"],"how_to_check":"- Check the installed ShopEngine version in the WordPress plugins list or `wp plugin get shopengine --field=version`\n- Confirm whether the ShopEngine Gutenberg WooCommerce Builder Blocks Addon is active on the site","fix":"- ShopEngine Gutenberg WooCommerce Builder Blocks Addon: `2.4.4` or later","status":"open","published_at":"2026-11-06T06:16:44+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:42+00:00","updated_at":"2026-11-06T06:41:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T06:41:42Z","model":"claude-haiku-5-5","output":{"fix":"- ShopEngine Gutenberg WooCommerce Builder Blocks Addon: `2.4.4` or later","reach":"network","title":"ShopEngine WordPress plugin: contributors can inject scripts that run for editors","impact":"medium","summary":"The ShopEngine Gutenberg WooCommerce Builder Blocks Addon before 2.4.4 lets a contributor-level WordPress user modify any post through an AJAX action without ownership checks. The stored value is not escaped in a JavaScript context, so injected scripts run when a higher-privileged user edits that post.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","shopengine"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Injected scripts run in an editor's browser session on the site","analyst_note":"","how_to_check":"- Check the installed ShopEngine version in the WordPress plugins list or `wp plugin get shopengine --field=version`\n- Confirm whether the ShopEngine Gutenberg WooCommerce Builder Blocks Addon is active on the site","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-untrusted-contributors"],"who_is_affected":"Sites running the ShopEngine Gutenberg WooCommerce Builder Blocks Addon before 2.4.4 are exposed. The attacker needs a contributor-level or higher account, and the script runs when a higher-privileged user edits the affected post. Sites where the plugin is not installed, or where no untrusted users can create contributor accounts, are less exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000733,"input_tokens":4275,"output_tokens":611,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92396':14A,17A '2.4.4':30B,81C 'action':44B,101C 'addon':28B,77C 'ajax':43B,100C 'allow':116C 'arbitrari':127C 'block':27B,76C 'builder':26B,75C 'capabl':88C 'check':47B 'context':57B,115C 'contributor':4A,34B,124C 'contributor-level':33B 'cve':12A,15A 'edit':68B,140C 'editor':11A 'escap':53B,105C 'gutenberg':24B,73C 'higher':65B,137C 'higher-privileg':64B 'inject':6A,59B,126C 'javascript':56B,114C 'let':31B 'level':35B 'low':122C 'modifi':38B 'one':97C 'output':110C 'ownership':46B,91C 'packag':18B 'plugin':3A,79C 'post':40B,70B,95C,131C 'privileg':66B,138C 'role':120C 'run':9A,61B,134C 'script':7A,60B,128C 'shopengin':1A,19B,23B,72C 'store':49B,107C 'target':94C 'user':37B,67B,86C,117C,139C 'valid':84C 'valu':50B,108C 'without':45B 'woocommerc':20B,25B,74C 'wordpress':2A,21B,36B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ShopEngine Gutenberg WooCommerce Builder Blocks Addon before 2.4.4 are exposed. The attacker needs a contributor-level or higher account, and the script runs when a higher-privileged user edits the affected post. Sites where the plugin is not installed, or where no untrusted users can create contributor accounts, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","shopengine","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-2026':13A,16A '-92396':14A,17A 'contributor':4A 'cve':12A,15A 'editor':11A 'inject':6A 'plugin':3A 'run':9A 'script':7A 'shopengin':1A 'wordpress':2A","search_b":"'2.4.4':30B 'action':44B 'addon':28B 'ajax':43B 'block':27B 'builder':26B 'check':47B 'context':57B 'contributor':34B 'contributor-level':33B 'edit':68B 'escap':53B 'gutenberg':24B 'higher':65B 'higher-privileg':64B 'inject':59B 'javascript':56B 'let':31B 'level':35B 'modifi':38B 'ownership':46B 'packag':18B 'post':40B,70B 'privileg':66B 'run':61B 'script':60B 'shopengin':19B,23B 'store':49B 'user':37B,67B 'valu':50B 'without':45B 'woocommerc':20B,25B 'wordpress':21B,36B","search_c":"'2.4.4':81C 'action':101C 'addon':77C 'ajax':100C 'allow':116C 'arbitrari':127C 'block':76C 'builder':75C 'capabl':88C 'context':115C 'contributor':124C 'edit':140C 'escap':105C 'gutenberg':73C 'higher':137C 'inject':126C 'javascript':114C 'low':122C 'one':97C 'output':110C 'ownership':91C 'plugin':79C 'post':95C,131C 'privileg':138C 'role':120C 'run':134C 'script':128C 'shopengin':72C 'store':107C 'target':94C 'user':86C,117C,139C 'valid':84C 'valu':108C 'woocommerc':74C 'wordpress':78C","first_public_at":"2026-11-06T06:16:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92396","severity":null,"published_at":"2026-11-06T06:16:44+00:00","modified_at":"2026-11-06T06:16:44+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}