CVE-2026-25438: Reflected XSS in Unlimited Blocks for Gutenberg

The primary impact of this vulnerability is the ability for an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can be achieved by crafting a malicious URL containing the XSS payload and tricking a user into clicking it. Successful exploitation could allow an attacker to steal session cookies, redirect users to phishing sites, or modify the content of the page. Given the plugin's functionality (adding blocks to Gutenberg), an attacker could potentially inject scripts that alter the appearance or behavior of the WordPress editor, further compromising the user's experience and potentially gaining access to sensitive data. The scope of impact is limited to users who interact with the vulnerable plugin and are tricked into visiting a malicious link.

1. Reserved2026-02-02
2. Published2026-03-19
3. Modified2026-04-28
4. EPSS updated2026-03-26

The primary mitigation for CVE-2026-25438 is to upgrade to a patched version of the Unlimited Blocks for Gutenberg plugin as soon as it becomes available. Until a patch is released, consider temporarily disabling the plugin if it is not essential. As a short-term workaround, implement strict input validation and output encoding on any user-supplied data that is displayed on the page. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide some protection, although they are not a substitute for patching the vulnerability. Monitor web server access logs for suspicious URL patterns containing JavaScript code.

Active installs

1KNiche

Plugin rating