CVE-2026-17011CWE-345

CVE-2026-17011

Low · published August 9, 2026

CVSS v3.1
3.8
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.0th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-08-09T10:18Z
References (1)
https://wpscan.com/vulnerability/a702e5cb-0fb3-419e-81df-fa5b26c81402/ · [email protected]
EPSS history
Timeline
  • 09 AUG 06:00Z
    Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection
    cvelistv5