High severity8.8NVD Advisory· Published Sep 19, 2026· Updated Sep 21, 2026
CVE-2026-88824
CVE-2026-88824
Description
The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <1.5.0
Patches
Vulnerability mechanics
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)Wordfence Blog · Sep 24, 2026