CVE-2026-92396— Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css

Quick assessment

Affected

Unknown ShopEngine Gutenberg WooCommerce Builder Blocks Addon

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ShopEngine Gutenberg WooCommerce Builder Blocks Addon 插件在 2.4.4 版本之前，在其某个 AJAX 操作中未验证用户权限或目标文章的归属关系，且在将存储值输出到 JavaScript 上下文前未进行转义处理。这导致权限低至“投稿者”（Contributor）角色的用户能够向任意文章注入任意脚本，这些脚本将在高权限用户编辑该文章时执行。

AI Predicted 7.4 Difficulty: Easy Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Updated Nov 06, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css

Source: CVE Program / CVE List V5

Vulnerability Description

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	ShopEngine Gutenberg WooCommerce Builder Blocks Addon	0 ~ 2.4.4	-

II. Public POCs for CVE-2026-92396

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-92396

请登录查看更多情报信息。

Other References for CVE-2026-92396 (1)

https://wpscan.com/vulnerability/f7db6391-4873-4de9-b300-456f3c9b7146/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-92396

Same Patch Batch · Unknown · 2026-11-06 · 30 CVEs total

CVE-2026-118423	10.0 CRITICAL	WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
CVE-2026-88800	9.1 CRITICAL	MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Rol
CVE-2026-88799	8.8 HIGH	MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover
CVE-2026-88801	8.0 HIGH	MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Ro
CVE-2026-121633	5.3 MEDIUM	Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Liste
CVE-2026-121636	5.3 MEDIUM	Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the
CVE-2026-118166	4.8 MEDIUM	MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution vi
CVE-2026-110813		Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Nam
CVE-2026-118239		AutomatorWP < 6.0.7 - Unauthenticated Zoom/AWeber Integration Connection Hijack via OAuth
CVE-2026-118188		PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure
CVE-2026-115673		Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email
CVE-2026-118167		MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Subscription Audience Override
CVE-2026-118187		PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR
CVE-2026-118186		PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revi
CVE-2026-86606		iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser
CVE-2026-110525		MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent
CVE-2026-113615		GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi
CVE-2026-12967		WCFM Membership < 2.12.1 - Subscriber+ Payment Verification Bypass
CVE-2026-87784		Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission
CVE-2026-119259		All-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write

Showing top 20 of 30 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Unknown