Exploitation ongoing with high activity in latest observed window (3 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_block shortcode in all versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping on user supplied values consumed from user-created content blocks. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
Attention, elevated activities detected targeting vanderwijk Content Blocks Plugin (CVE-2026-0894) https://vuldb.com/vuln/358193/cti
Post summary
Alert announces that potentially malicious activity targeting the vanderwijk Content Blocks Plugin (CVE-2026-0894) has been observed, suggesting active exploitation in the wild, but no concrete details or mitigation steps are provided.
CVE-2026-0894 The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_block shortcode in all versions up to… https://www.cve.org/CVERecord?id=CVE-2026-0894
Post summary
The post announces CVE‑2026‑0894 as a Stored XSS flaw in WordPress's Content Blocks plugin, providing technical details but no PoC, exploit, patch, or active exploitation evidence.
CVE-2026-0894 Stored Cross-Site Scripting in Content Blocks Custom Post Widget Plugin WordPress 3.3.9 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-0894
Post summary
A CVE‑2026‑0894 vulnerability is disclosed, describing a stored cross‑site scripting issue in the WordPress Content Blocks Custom Post Widget Plugin v3.3.9, but no PoC, exploit, patch, or active exploitation details are shared.