Medium severity6.4NVD Advisory· Published Nov 7, 2026· Updated Nov 7, 2026
CVE-2026-9601
CVE-2026-9601
Description
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_block_style' endpoint in all versions up to, and including, 3.19.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected products
2- Range: <=3.19.9
Patches
Vulnerability mechanics
References
11- github.com/gambitph/Stackable/pull/3725nvd
- plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.phpnvd
- plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.phpnvd
- plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.phpnvd
- plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.phpnvd
- plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.8/src/deprecated/block-defaults/custom-block-styles.phpnvd
- plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.8/src/deprecated/block-defaults/custom-block-styles.phpnvd
- plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.8/src/deprecated/block-defaults/custom-block-styles.phpnvd
- plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.8/src/deprecated/block-defaults/custom-block-styles.phpnvd
- plugins.trac.wordpress.org/changeset/3609541/stackable-ultimate-gutenberg-blocks/trunk/src/deprecated/block-defaults/custom-block-styles.phpnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/1d4da874-23c8-4df4-b776-6046ce8d705anvd
News mentions
0No linked articles in our index yet.