CVE-2026-9601

CVSS 6.4 (medium) · published 2026-11-07

The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_block_style' endpoint in all versions up to, and including, 3.19.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Weakness: CWE-79

Source: NVD CVE-2026-9601

References

• https://github.com/gambitph/Stackable/pull/3725
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.php#L155
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.php#L181
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.php#L223
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.php#L432
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.8/src/deprecated/block-defaults/custom-block-styles.php#L155
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.8/src/deprecated/block-defaults/custom-block-styles.php#L181
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.8/src/deprecated/block-defaults/custom-block-styles.php#L223
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.8/src/deprecated/block-defaults/custom-block-styles.php#L432
• https://plugins.trac.wordpress.org/changeset/3609541/stackable-ultimate-gutenberg-blocks/trunk/src/deprecated/block-defaults/custom-block-styles.php

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.