CVE-2026-3498

OVERVIEW CVE-2026-3498 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the BlockArt Blocks plugin for WordPress in all versions up to and including 2.2.15. The flaw stems from insufficient input sanitization and output escaping of the 'clientId' block attribute, allowing authenticated attackers with Author-level privileges or higher to inject malicious scripts into WordPress pages. SEVERITY The vulnerability carries a CVSS v3.1 score of 6.4 (Medium) with a network-based attack vector requiring low complexity and low privilege requirements. The impact is limited to confidentiality and integrity breaches with no availability impact. The attack requires user interaction in the form of accessing an injected page, though the scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component. EXPLOITATION STATUS This vulnerability is not currently tracked on CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no indicators of active exploitation. The EPSS score of 0.00034 indicates very low probability of exploitation in the wild relative to other CVEs. The vulnerability remains on an inactive Hot List status, suggesting minimal community attention or public exploit code availability at this time.