CVE-2026-104400: B Blocks WordPress Plugin XSS Vulnerability

CVE-2026-104400 Overview

CVE-2026-104400 is a stored cross-site scripting (XSS) vulnerability in the bPlugins B Blocks WordPress plugin. The flaw affects all versions of B Blocks up to and including 2.1.8. It stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79].

An authenticated attacker with low privileges can inject malicious JavaScript that executes in the browser of any user viewing the affected page. The scoped impact crosses a trust boundary, allowing stored payloads to affect administrators and site visitors. User interaction is required to trigger the payload.

Critical Impact
Authenticated contributors can persist JavaScript payloads that execute in administrator sessions, enabling session theft, account takeover, and further compromise of WordPress sites.

Affected Products

bPlugins B Blocks WordPress plugin versions through 2.1.8
WordPress sites running the b-blocks plugin
All configurations where contributors or higher roles can edit B Blocks content

Discovery Timeline

2026-10-05 - CVE-2026-104400 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104400

Vulnerability Analysis

The vulnerability resides in the B Blocks plugin's handling of block attributes submitted through the WordPress block editor. Input provided by authenticated users is stored in the database and later rendered into post content without adequate output encoding or sanitization.

When a victim loads a page containing the malicious block, the injected script executes in the context of the WordPress site origin. Because the stored payload persists in post content, it affects every subsequent viewer until the content is removed or sanitized.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin fails to apply WordPress sanitization helpers such as wp_kses_post() or esc_attr() on block attributes before echoing them to the DOM, allowing attribute- or tag-level JavaScript to render verbatim.

Attack Vector

Exploitation requires an attacker to hold a WordPress account with at least contributor-level privileges to create or edit content using B Blocks. The attacker inserts a crafted payload into a block field that accepts rich input or attributes.

A victim with higher privileges, typically an editor or administrator, previews or publishes the affected content and triggers execution. The resulting script runs under the site origin, exposing session cookies, nonces, and administrative endpoints.

See the Patchstack XSS Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2026-104400

Indicators of Compromise

Unexpected <script> tags, on*= event handlers, or javascript: URIs stored in wp_posts content for posts containing B Blocks markup
Administrator sessions issuing unexpected REST API calls to /wp-json/wp/v2/users or plugin management endpoints shortly after viewing content
New administrator accounts or modified user roles created without a corresponding admin login event

Detection Strategies

Query the WordPress database for wp_posts rows containing wp:b-blocks block markers alongside suspicious HTML attributes or script content
Review web server logs for POST requests to /wp-admin/post.php and /wp-json/wp/v2/ endpoints originating from low-privilege accounts
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on pages rendering B Blocks

Monitoring Recommendations

Enable WordPress audit logging to track content edits by contributor and author accounts
Alert on privilege escalation events, including role changes and new administrator creation
Correlate anomalous outbound requests from admin browsers with recent content preview or publish actions

How to Mitigate CVE-2026-104400

Immediate Actions Required

Audit installed B Blocks versions across all WordPress sites and identify instances at or below 2.1.8
Review user roles and reduce contributor, author, and editor accounts to the minimum necessary
Inspect existing B Blocks content for stored payloads and purge any suspicious markup

Patch Information

At the time of publication, the Patchstack advisory lists versions through 2.1.8 as affected. Site operators should consult the Patchstack XSS Vulnerability Advisory and the plugin repository for the latest fixed release and upgrade immediately once available.

Workarounds

Deactivate and remove the B Blocks plugin until a patched version is installed
Deploy a web application firewall rule to block requests containing <script> tags or event handler attributes targeting B Blocks endpoints
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin and front-end pages
Restrict block editor access to trusted administrator accounts only

bash

# Configuration example: enumerate B Blocks installations with WP-CLI
wp plugin list --name=b-blocks --fields=name,status,version

# Deactivate the plugin pending remediation
wp plugin deactivate b-blocks