CVE-2026-88824— Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings
Quick assessment
Affected
Unknown Master Blocks
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Master Blocks WordPress 插件 1.5.0 版本之前的版本中，其中一个 REST API 路由缺少权限验证，使得未认证的用户能够更新该插件的设置，其中包括一个在后台管理区域以未转义方式输出的值，从而导致存储型跨站脚本（Stored XSS）攻击，且该脚本会在任何访问 wp-admin 页面的管理员会话中执行。
Possible ATT&CK Techniques 3 AI
T1135 · Network Share Discovery T1059.003 · Windows Command Shell T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88824
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings
Source: CVE Program / CVE List V5
Vulnerability Description
The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Master Blocks | 1.4.1 ~ 1.5.0 | - |
|
II. Public POCs for CVE-2026-88824
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88824
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-88824 (1)
-
🔗 Master Blocks 1.4.1 – 1.4.1.4 – Unauthenticated Stored XSS via White Label Settings | CVE 2026-88824 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-19 · 21 CVEs total
| CVE-2026-86814 | UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider | |
| CVE-2025-15698 | Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting | |
| CVE-2026-19860 | JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validati | |
| CVE-2026-16557 | Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_con | |
| CVE-2026-84750 | Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload | |
| CVE-2026-76554 | WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import | |
| CVE-2026-76790 | Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter | |
| CVE-2026-85574 | Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unb | |
| CVE-2026-85680 | Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title | |
| CVE-2026-86591 | Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder R | |
| CVE-2026-92435 | Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API | |
| CVE-2026-91847 | Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection | |
| CVE-2026-92099 | WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squ | |
| CVE-2026-88926 | VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi | |
| CVE-2026-92404 | MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure | |
| CVE-2026-92425 | Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR | |
| CVE-2026-92420 | Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR | |
| CVE-2026-92421 | Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR | |
| CVE-2026-92403 | Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Sub | |
| CVE-2026-92430 | Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webh |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-92435
Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken A -
CVE-2026-92430
Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order St -
CVE-2026-92403
Secure Custom Fields < 6.9.4 - Unauthenticated Post Modifica -
CVE-2026-92421
Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Tak -
CVE-2026-92420
Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Delet
V. Comments for CVE-2026-88824
No comments yet