WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability

The primary impact of this vulnerability is the ability for an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can be achieved by crafting a malicious URL containing the XSS payload and tricking a user into clicking it. Successful exploitation could allow an attacker to steal session cookies, redirect users to phishing sites, or modify the content of the page. Given the plugin's functionality (adding blocks to Gutenberg), an attacker could potentially inject scripts that alter the appearance or behavior of the WordPress editor, further compromising the user's experience and potentially gaining access to sensitive data. The scope of impact is limited to users who interact with the vulnerable plugin and are tricked into visiting a malicious link.

Websites using the Unlimited Blocks for Gutenberg plugin, particularly those with user-generated content or where users are likely to click on links from untrusted sources, are at risk. Shared hosting environments where multiple websites share the same server infrastructure could also be affected if one site is compromised and used to distribute malicious links.

• wordpress / composer / npm:

grep -r 'Unlimited Blocks for Gutenberg' /var/www/html/wp-content/plugins/
wp plugin list | grep 'Unlimited Blocks for Gutenberg'

• generic web:

curl -I 'https://example.com/?param=<script>alert(1)</script>' | grep 'Content-Security-Policy'

1. 2026-03-19Disclosure

   disclosure

1. Réservé2026-02-02
2. Publiée2026-03-19
3. Modifiée2026-04-28
4. EPSS mis à jour2026-03-26

The primary mitigation for CVE-2026-25438 is to upgrade to a patched version of the Unlimited Blocks for Gutenberg plugin as soon as it becomes available. Until a patch is released, consider temporarily disabling the plugin if it is not essential. As a short-term workaround, implement strict input validation and output encoding on any user-supplied data that is displayed on the page. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide some protection, although they are not a substitute for patching the vulnerability. Monitor web server access logs for suspicious URL patterns containing JavaScript code.

Installations actives

1KNiche

Note du plugin