---
id: "CVE-2026-92396"
page: "https://infrastack.ai/live/CVE-2026-92396"
kind: "vulnerability"
aliases: ["CVE-2026-92396"]
title: "ShopEngine WordPress plugin: contributors can inject scripts that run for editors"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "shopengine", "woocommerce", "wordpress"]
not_affected_if: ["no-untrusted-contributors", "plugin-not-installed"]
published_at: "2026-11-06T06:16:44+00:00"
first_seen_at: "2026-11-06T06:40:12+00:00"
updated_at: "2026-11-06T06:41:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92396", "first_seen_at": "2026-11-06T06:40:12+00:00"}]
exploit_sources: []
---

# ShopEngine WordPress plugin: contributors can inject scripts that run for editors

Link for people: https://infrastack.ai/live/CVE-2026-92396 (this .md is for agents)

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon before 2.4.4 lets a contributor-level WordPress user modify any post through an AJAX action without ownership checks. The stored value is not escaped in a JavaScript context, so injected scripts run when a higher-privileged user edits that post.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ShopEngine version in the WordPress plugins list or `wp plugin get shopengine --field=version`
- Confirm whether the ShopEngine Gutenberg WooCommerce Builder Blocks Addon is active on the site

## Fix

- ShopEngine Gutenberg WooCommerce Builder Blocks Addon: `2.4.4` or later

## Timeline

- 2026-11-06T06:40:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92396

## From the sources

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon  WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_