WordPress Plugin Vulnerabilities

All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute

Description

The plugin does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

Proof of Concept

Affects Plugins

Plugin icon
all-bootstrap-blocks
No known fix

References

CVE
CVE-2026-88993

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
fc1f2f62-62cd-4a70-b541-2278eb0edefe

Timeline

Publicly Published
2026-09-16 (about 2 days ago)
Added
2026-09-16 (about 1 day ago)
Last Updated
2026-09-16 (about 1 day ago)

Other

Published
Title
Published
2023-11-07
Title
ANAC XML Viewer < 1.7.1 - Admin+ Stored XSS
Published
2025-10-24
Title
SpendeOnline.org < 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-06-16
Title
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program < 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute
Published
2025-03-24
Title
PowerPress Podcasting < 11.9.18 - Author+ XSS via Podcast URL
Published
2025-12-11
Title
Easy Map Creator <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes