Nexter Blocks <= 4.7.4 认证用户存储型XSS漏洞(CVE-2026-6740)及修复指南

漏洞概述 漏洞名称: Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commenticon' Block Attribute CVE ID: CVE-2026-6740 CVSS 评分: 6.4 (Medium) 发布日期: 2026年7月7日 最后更新日期: 2026年7月8日 研究人员: Muhammad Yodha - DJ 影响范围 软件类型: 插件 软件名称: Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder 受影响版本: <= 4.7.4 修复版本: 4.7.5 修复方案 修复措施: 更新到版本 4.7.5 或更新的已修复版本 漏洞描述 Nexter Blocks 插件在 WordPress 中存储跨站脚本（XSS）漏洞，通过 'commenticon' 参数在所有版本中受到影响，包括 4.7.4 版本，原因是输入 sanitization 和输出转义不足。这使得具有贡献者级别访问权限及更高权限的认证攻击者可以在页面中注入任意脚本，每次用户访问注入页面时都会执行。 参考链接 plugins.trac.wordpress.org 其他信息 软件类型: Plugin 软件 Slug: the-plus-addons-for-block-editor 是否已修复: Yes 修复版本: 4.7.5 近期漏洞列表 其他资源 查看此软件包中的更多漏洞: VIEW MORE VULNERABILITIES IN THIS SOFTWARE PACKAGE 版权声明 版权: © 2012-2026 Defiant Inc. 许可证: Defiant 授予您永久、全球、非独占、免版税、不可撤销的版权许可，以复制、准备衍生作品、公开显示、公开表演、分发和分发软件漏洞信息。任何复制的软件漏洞信息必须包含 Defiant 的版权声明和此许可证。更多信息请参见 Read more。 联系信息 联系邮箱: wfsupport@wordfence.com 业务时间 营业时间: 9am-6pm ET, 6am-5pm PT 和 2pm-1am UTC/GMT（不包括周末和节假日） 响应时间: 客户支持提供 24 小时支持，每年 365 天，响应时间为 1 小时 页脚链接 服务条款: Terms of Service 隐私政策和通知: Privacy Policy and Notice at Collection 不卖或分享我的个人信息: Do Not Sell or Share My Personal Information 社交媒体链接 Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram 产品和支持链接 Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central 支持链接 Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support 新闻链接 Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories 关于链接 About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form 订阅链接 Sign up for news and updates from our panel of experienced security professionals: Sign up 版权信息 © 2012-2026 Defiant Inc. All Rights Reserved 其他资源 Learn More: LEARN MORE Get Wordfence: GET WORDFENCE Documentation: DOCUMENTATION 业务时间 Our business hours are 9am-6pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. 页脚链接 Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information 社交媒体链接 Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram 产品和支持链接 Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central 支持链接 Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support 新闻链接 Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories 关于链接 About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form 订阅链接 Sign up for news and updates from our panel of experienced security professionals: Sign up 版权信息 © 2012-2026 Defiant Inc. All Rights Reserved 其他资源 Learn More: LEARN MORE Get Wordfence: GET WORDFENCE Documentation: DOCUMENTATION 业务时间 Our business hours are 9am-6pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. 页脚链接 Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information 社交媒体链接 Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram 产品和支持链接 Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central 支持链接 Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support 新闻链接 Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories 关于链接 About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form 订阅链接 Sign up for news and updates from our panel of experienced security professionals: Sign up 版权信息 © 2012-2026 Defiant Inc. All Rights Reserved 其他资源 Learn More: LEARN MORE Get Wordfence: GET WORDFENCE Documentation: DOCUMENTATION 业务时间 Our business hours are 9am-6pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response customers

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Nexter Blocks <= 4.7.4 认证用户存储型XSS漏洞(CVE-2026-6740)及修复指南

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Nexter Blocks <= 4.7.4 认证用户存储型XSS漏洞(CVE-2026-6740)及修复指南

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！