Nexter Blocks <= 4.7.4 Authenticated Stored XSS via commenticon (CVE-2026-6740) Advisory

Vulnerability Overview Vulnerability Name: Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commenticon' Block Attribute CVE ID: CVE-2026-6740 CVSS Score: 6.4 (Medium) Publication Date: July 7, 2026 Last Updated Date: July 8, 2026 Researchers: Muhammad Yodha - DJ Affected Products Software Type: Plugin Software Name: Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder Affected Versions: <= 4.7.4 Fixed Versions: 4.7.5 Remediation Remediation Action: Update to version 4.7.5 or later. Vulnerability Description The Nexter Blocks plugin contains a stored cross-site scripting (XSS) vulnerability in WordPress affecting all versions up to and including 4.7.4. The issue arises from insufficient input sanitization and output escaping for the 'commenticon' attribute. This allows authenticated attackers with contributor-level access or higher to inject arbitrary scripts into pages, which are then executed every time a user visits the compromised page. Reference Links plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: the-plus-addons-for-block-editor Fixed: Yes Fixed Version: 4.7.5 Recent Vulnerability List Other Resources View more vulnerabilities in this software package: VIEW MORE VULNERABILITIES IN THIS SOFTWARE PACKAGE Copyright Notice Copyright: © 2012-2026 Defiant Inc. License: Defiant grants you a permanent, worldwide, non-exclusive, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, distribute, and sublicense the software vulnerability information. Any copy of the software vulnerability information must contain the Defiant copyright notice and this license. For more information, please see Read more. Contact Information Contact Email: wfsupport@wordfence.com Business Hours Business Hours: 9am-6pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: Customer support provides 24-hour support, 365 days a year, with a 1-hour response time. Footer Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Links Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Product and Support Links Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Links Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Links Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About Links About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Subscription Links Sign up for news and updates from our panel of experienced security professionals: Sign up Copyright Info © 2012-2026 Defiant Inc. All Rights Reserved Other Resources Learn More: LEARN MORE Get Wordfence: GET WORDFENCE Documentation: DOCUMENTATION Business Hours Our business hours are 9am-6pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. Footer Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Links Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Product and Support Links Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Links Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Links Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About Links About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Subscription Links Sign up for news and updates from our panel of experienced security professionals: Sign up Copyright Info © 2012-2026 Defiant Inc. All Rights Reserved Other Resources Learn More: LEARN MORE Get Wordfence: GET WORDFENCE Documentation: DOCUMENTATION Business Hours Our business hours are 9am-6pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response customers receive 24-hour support, 365 days a year, with a 1-hour response time. Foot

Goal Reached Thanks to every supporter — we hit 100%!

Nexter Blocks <= 4.7.4 Authenticated Stored XSS via commenticon (CVE-2026-6740) Advisory

More from this source