CVE-2026-0894

OVERVIEW CVE-2026-0894 is a Stored Cross-Site Scripting (XSS) vulnerability in the Content Blocks (Custom Post Widget) plugin for WordPress affecting all versions up to and including 3.3.9. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's content_block shortcode, allowing malicious script injection into WordPress pages. SEVERITY The vulnerability carries a CVSS 3.1 score of 6.4 (MEDIUM) with a network-based attack vector requiring low complexity and low privileges. Exploitation requires authenticated access at contributor level or above, with no user interaction necessary. The impact is limited to confidentiality and integrity compromise with no availability impact. The FAUCET Risk Score of 44.0 out of 100 indicates moderate overall risk. EXPLOITATION STATUS There is currently no evidence of active exploitation, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and shows an extremely low EPSS score of 0.0001. The vulnerability remains inactive on threat intelligence hot lists. Organizations should nevertheless prioritize patching to versions above 3.3.9 to prevent potential exploitation by insider threats with contributor-level access.