Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The BlockArt Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'clientId' block attribute in all versions up to, and including, 2.2.15. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-11 | 1 | Disclosure1 |
| 2026-04-18 | 1 | PoC1 |
CVE-2026-3498 The BlockArt Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'clientId' block attribute in all versions up to, and including, 2.2.15. T… https://www.cve.org/CVERecord?id=CVE-2026-3498
Post summary
CVE‑2026‑3498 is a stored XSS flaw in the BlockArt Blocks WordPress plugin that affects all versions up to 2.2.15 via the 'clientId' block attribute.
https://atomicedge.io/cve-proof/cve-2026-3498-blockart-blocks-version-2-2-15-medium-vulnerability-proof-of-concept CVE-2026-3498 #WordPress plugin #vulnerability blockart-blocks #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
The post shares a proof‑of‑concept for CVE‑2026‑3498 affecting the BlockArt Blocks plugin, but lacks exploit code, active exploitation evidence, patch details, or technical specifics.