CVE-2026-6378: Maxi Blocks WordPress Plugin XSS Vulnerability

CVE-2026-6378 Overview

CVE-2026-6378 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Maxi Blocks plugin for WordPress in all versions up to and including 2.1.9. The flaw resides in the /wp-json/maxi-blocks/v1.0/style-card REST API endpoint, which fails to sanitize input or escape output for the sc_styles parameter. Authenticated attackers with Author-level access or higher can inject arbitrary JavaScript that executes when the plugin's style card styles are rendered. Because the injected payload loads on every page using these styles, including the WordPress admin panel, attackers can target administrators and other privileged users.

Critical Impact

Authenticated Author-level attackers can inject persistent JavaScript that executes across the entire WordPress admin panel, enabling session theft, account takeover, and administrative actions performed in the context of higher-privileged users.

Affected Products

• Maxi Blocks plugin for WordPress, versions up to and including 2.1.9
• WordPress sites with Author-level (or higher) user registration enabled
• Front-end and admin pages where Maxi Blocks style card styles are loaded

Discovery Timeline

• 2026-05-02 - CVE-2026-6378 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-6378

Vulnerability Analysis

The vulnerability stems from the Maxi Blocks plugin's handling of style card data submitted through its REST API. The /wp-json/maxi-blocks/v1.0/style-card endpoint accepts a sc_styles parameter, which is stored and later rendered into the page output as CSS or markup associated with the plugin's style cards. The plugin neither sanitizes the incoming sc_styles value nor escapes it on output, allowing arbitrary script content to persist in the database.

When a victim loads any page that pulls in the affected style card styles, the injected payload executes in their browser session. Because Maxi Blocks style cards are loaded across both front-end pages and the WordPress admin dashboard, a payload submitted by a low-privileged author propagates into administrator sessions. The attacker's script then runs with the victim's privileges in the same origin as the WordPress site.

Root Cause

The root cause is missing input validation and output encoding in the REST API handler defined in class-maxi-api.php and the rendering logic in class-maxi-style-cards.php. According to the patched code references in version 2.1.10, the fix introduces sanitization at multiple lines (L979, L981, L987, L1010, L1021) where sc_styles is processed. The pre-patch code path passed user-controlled data directly into stored style content without filtering script-bearing constructs.

Attack Vector

An attacker authenticates to a target WordPress site as an Author or higher. The attacker issues an authenticated POST request to /wp-json/maxi-blocks/v1.0/style-card with a malicious sc_styles payload containing JavaScript constructs that survive the plugin's storage and rendering pipeline. After submission, the payload is persisted as part of the plugin's style card configuration. Subsequent visits to any page that loads these styles, including /wp-admin/, trigger script execution in the visitor's browser. The attacker can then exfiltrate cookies, perform CSRF-style actions against the admin REST API, or pivot to administrator account takeover.

For implementation specifics, see the GitHub pull request fixing the issue and the Wordfence vulnerability advisory.

Detection Methods for CVE-2026-6378

Indicators of Compromise

• POST or PUT requests to /wp-json/maxi-blocks/v1.0/style-card containing <script, onerror=, javascript:, or HTML event handler substrings within the sc_styles parameter.
• Unexpected <script> tags, expression(), or url(javascript:...) constructs inside Maxi Blocks style card records stored in the WordPress database (wp_options or plugin-specific tables).
• Outbound requests from administrator browsers to attacker-controlled domains shortly after loading WordPress admin pages.
• New or modified administrator accounts created shortly after an Author-level user interacted with the style card endpoint.

Detection Strategies

• Inspect web server access logs for authenticated requests to the style-card REST route originating from non-administrator user sessions.
• Query the WordPress database for Maxi Blocks style card entries containing HTML or JavaScript syntax that does not belong in CSS values.
• Monitor browser-side Content Security Policy (CSP) violation reports referencing inline scripts on /wp-admin/ pages.

Monitoring Recommendations

• Enable WordPress audit logging for REST API calls and track the user role associated with each request to the affected endpoint.
• Alert on creation, deletion, or privilege changes of administrator accounts following Author-level activity on the style-card endpoint.
• Capture and review HTTP request bodies for the Maxi Blocks REST routes at the WAF layer to retain forensic evidence of injection attempts.

How to Mitigate CVE-2026-6378

Immediate Actions Required

• Upgrade the Maxi Blocks plugin to version 2.1.10 or later on every affected WordPress site.
• Audit existing Author, Editor, and Contributor accounts and remove any that are unnecessary or unrecognized.
• Review stored Maxi Blocks style card records and remove entries containing script tags, event handlers, or javascript: URIs.
• Force password resets and invalidate active sessions for administrators who may have loaded compromised pages.

Patch Information

The vendor addressed the vulnerability in Maxi Blocks 2.1.10. The patch adds sanitization for the sc_styles parameter at the REST API boundary and during style card rendering. See the version 2.1.10 source in class-maxi-api.php and the GitHub pull request diff for the specific code changes.

Workarounds

• Restrict Author and higher role assignments to trusted users until the plugin is updated.
• Deploy a Web Application Firewall (WAF) rule that blocks requests to /wp-json/maxi-blocks/v1.0/style-card containing HTML or script syntax in the sc_styles field.
• Temporarily disable the Maxi Blocks plugin on sites where patching cannot be applied immediately.
• Apply a strict Content Security Policy that disallows inline scripts on admin and front-end pages.

# Example WAF rule (ModSecurity) blocking script payloads in sc_styles
SecRule REQUEST_URI "@beginsWith /wp-json/maxi-blocks/v1.0/style-card" \
    "id:1026378,phase:2,deny,status:403,log,\
    msg:'CVE-2026-6378 Maxi Blocks Stored XSS attempt',\
    chain"
    SecRule ARGS:sc_styles "@rx (?i)(<script|onerror=|onload=|javascript:|expression\()" \
        "t:none,t:urlDecodeUni"