{"id":"CVE-2026-9601","kind":"vulnerability","aliases":["CVE-2026-9601"],"related":[],"title":"Stackable Page Builder WordPress plugin: stored XSS via block style endpoint","description":"The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_block_style' endpoint in all versions up to, and including, 3.19.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The Stackable Page Builder Gutenberg Blocks plugin for WordPress does not sanitize input to its update_block_style endpoint, so stored scripts are saved. An attacker with contributor access can inject scripts that run in the browser of anyone who opens the injected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","stackable","wordpress"],"not_affected_if":["contributor-accounts-not-used","plugin-not-installed"],"how_to_check":"- Check the installed version of the Stackable plugin in the WordPress admin plugin list or `wp plugin get stackable-ultimate-gutenberg-blocks --field=version` (plugin slug assumed; unknown if the sources do not confirm it)\n- Confirm whether any installed version is `3.19.9` or earlier","fix":"- Versions up to and including `3.19.9` are affected; the sources do not state a fixed version","status":"open","published_at":"2026-11-07T05:19:03+00:00","first_seen_at":"2026-11-07T05:46:09+00:00","triaged_at":"2026-11-07T05:52:34+00:00","updated_at":"2026-11-07T05:52:34+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T05:52:34Z","model":"claude-haiku-5-5","output":{"fix":"- Versions up to and including `3.19.9` are affected; the sources do not state a fixed version","reach":"network","title":"Stackable Page Builder WordPress plugin: stored XSS via block style endpoint","impact":"medium","summary":"The Stackable Page Builder Gutenberg Blocks plugin for WordPress does not sanitize input to its update_block_style endpoint, so stored scripts are saved. An attacker with contributor access can inject scripts that run in the browser of anyone who opens the injected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","stackable","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Injected scripts run in visitors' browsers and can steal sessions","analyst_note":"","how_to_check":"- Check the installed version of the Stackable plugin in the WordPress admin plugin list or `wp plugin get stackable-ultimate-gutenberg-blocks --field=version` (plugin slug assumed; unknown if the sources do not confirm it)\n- Confirm whether any installed version is `3.19.9` or earlier","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","contributor-accounts-not-used"],"who_is_affected":"Sites running the Stackable Page Builder Gutenberg Blocks plugin version 3.19.9 or earlier, where contributor-level or higher accounts exist. Sites without the plugin, or running a later version, are not affected according to the sources' version range.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":4293,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-9601':14A,17A '3.19.9':98C 'access':52B,118C,134C 'anyon':62B 'arbitrari':123C 'attack':49B,113C 'authent':112C 'block':9A,29B,40B,73C,88C 'browser':60B 'builder':3A,27B,71C 'contributor':51B,116C 'contributor-level':115C 'cross':82C 'cross-sit':81C 'cve':12A,15A 'due':99C 'endpoint':11A,42B,90C 'escap':106C 'execut':130C 'gutenberg':28B,72C 'host':21B 'includ':97C 'inject':54B,66B,122C,136C 'input':36B,102C 'insuffici':101C 'level':117C 'make':108C 'open':64B 'output':105C 'packag':18B 'page':2A,26B,67B,70C,127C,137C 'plugin':5A,30B,74C 'possibl':110C 'run':57B 'sanit':35B,103C 'save':47B 'script':45B,55B,84C,125C 'self':20B 'self-host':19B 'site':83C 'stackabl':1A,22B,25B,69C 'store':6A,44B,80C 'style':10A,41B,89C 'updat':39B,87C 'user':133C 'version':93C 'via':8A,85C 'vulner':78C 'web':124C 'whenev':131C 'wordpress':4A,23B,32B,76C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Stackable Page Builder Gutenberg Blocks plugin version 3.19.9 or earlier, where contributor-level or higher accounts exist. Sites without the plugin, or running a later version, are not affected according to the sources' version range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","stackable","wordpress"],"campaign_type":null,"search_a":"'-2026':13A,16A '-9601':14A,17A 'block':9A 'builder':3A 'cve':12A,15A 'endpoint':11A 'page':2A 'plugin':5A 'stackabl':1A 'store':6A 'style':10A 'via':8A 'wordpress':4A 'xss':7A","search_b":"'access':52B 'anyon':62B 'attack':49B 'block':29B,40B 'browser':60B 'builder':27B 'contributor':51B 'endpoint':42B 'gutenberg':28B 'host':21B 'inject':54B,66B 'input':36B 'open':64B 'packag':18B 'page':26B,67B 'plugin':30B 'run':57B 'sanit':35B 'save':47B 'script':45B,55B 'self':20B 'self-host':19B 'stackabl':22B,25B 'store':44B 'style':41B 'updat':39B 'wordpress':23B,32B","search_c":"'3.19.9':98C 'access':118C,134C 'arbitrari':123C 'attack':113C 'authent':112C 'block':73C,88C 'builder':71C 'contributor':116C 'contributor-level':115C 'cross':82C 'cross-sit':81C 'due':99C 'endpoint':90C 'escap':106C 'execut':130C 'gutenberg':72C 'includ':97C 'inject':122C,136C 'input':102C 'insuffici':101C 'level':117C 'make':108C 'output':105C 'page':70C,127C,137C 'plugin':74C 'possibl':110C 'sanit':103C 'script':84C,125C 'site':83C 'stackabl':69C 'store':80C 'style':89C 'updat':87C 'user':133C 'version':93C 'via':85C 'vulner':78C 'web':124C 'whenev':131C 'wordpress':76C","first_public_at":"2026-11-07T05:19:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9601","severity":null,"published_at":"2026-11-07T05:19:03+00:00","modified_at":"2026-11-07T05:19:03+00:00","first_seen_at":"2026-11-07T05:46:09+00:00","fetched_at":"2026-11-07T05:46:09+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}