[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNh9CFDSQhd-VquDJuDMuuJLbLWY1Ik9iHFqKKfs2dm4":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"source_links":41},"CVE-2026-5711","post-blocks-tools-authenticated-author-stored-cross-site-scripting-via-sliderstyle-block-attribute","Post Blocks & Tools \u003C= 1.3.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute","The Post Blocks & Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sliderStyle' block attribute in the Posts Slider block in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","bnm-blocks",null,"\u003C=1.3.0","1.3.1","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-04-08 09:11:09","2026-04-08 21:25:26",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Faeada6dc-0851-45e8-ada9-ff0427b7f17a?source=api-prod",1,[22,23,24,25,26,27,28,29],"bnm-blocks.php","readme.txt","src\u002Fblocks\u002Fposts\u002Ffeatured-posts-1\u002Fview.php","src\u002Fblocks\u002Fposts\u002Ffeatured-posts-2\u002Fview.php","src\u002Fblocks\u002Fposts\u002Fpost-block-1\u002Fview.php","src\u002Fblocks\u002Fposts\u002Fpost-block-2\u002Fview.php","src\u002Fblocks\u002Fposts\u002Fposts-ultra\u002Fview.php","src\u002Fblocks\u002Fposts\u002Fslider\u002Fview.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-5711 (Post Blocks & Tools \u003C= 1.3.0)\n\n## 1. Vulnerability Summary\nThe **Post Blocks & Tools** plugin for WordPress is vulnerable to **Stored Cross-Site Scripting (XSS)** via the `sliderStyle` attribute of the **Posts Slider** block. In version 1.3.0 and below, the plugin fails to sanitize this attribute before using it to construct a CSS class name, which is then rendered on the page. Since authors can create posts and define block attributes, an authenticated attacker with Author-level permissions can inject arbitrary JavaScript that executes in the context of any user viewing the affected post.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** WordPress REST API `POST \u002Fwp-json\u002Fwp\u002Fv2\u002Fposts` (or the Gutenberg editor).\n- **Authentication:** Author-level or higher (`edit_posts` capability).\n- **Vulnerable Attribute:** `sliderStyle` within the `bnm-blocks\u002Fposts-slider` block.\n- **Payload Carry:** The payload is embedded in the JSON-encoded block attributes within the post content.\n- **Preconditions:** The plugin `bnm-blocks` must be active, and an attacker must have credentials for an Author-level account.\n\n## 3. Code Flow\n1. **Entry Point:** A user saves a post containing a `bnm-blocks\u002Fposts-slider` block. The block's attributes are stored as a JSON comment in `","The Post Blocks & Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via various block attributes such as 'sliderStyle', 'sectionHeaderStyle', and 'columns'. This occurs because version 1.3.0 and below fail to sanitize or escape these attributes before including them in HTML class names on the frontend, allowing authenticated authors to inject malicious JavaScript into posts.","\u002F\u002F src\u002Fblocks\u002Fposts\u002Fslider\u002Fview.php line 207\n$slider_style_class = 'bnm-sw-' . $attributes['sliderStyle'];\n\n$classes = array( 'wpbnmposw', 'bnmbcs', $slider_style_class );\n\n\u002F\u002F ...\n\nif ( $attributes['sectionHeaderStyle'] ) {\n    $classes[] = 'bnm-bhs-' . $attributes['sectionHeaderStyle'];\n}\n\n---\n\n\u002F\u002F src\u002Fblocks\u002Fposts\u002Fposts-ultra\u002Fview.php line 173\nif ( isset( $attributes['columns'] ) && 'grid' === $attributes['postLayout'] ) {\n    $classes[] = 'columns-' . $attributes['columns'];\n}\n\nif ( $attributes['showFeaturedImage'] && isset( $attributes['imagePosition'] ) ) {\n    $classes[] = 'image-align' . $attributes['imagePosition'];\n}\n\nif ( $attributes['textAlign'] ) {\n    $classes[] = 'has-text-align' . $attributes['textAlign'];\n}\n\n\u002F\u002F ...\n\nif ( $attributes['sectionHeaderStyle'] ) {\n    $classes[] = 'bnm-bhs-' . $attributes['sectionHeaderStyle'];\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbnm-blocks\u002F1.3.0\u002Fsrc\u002Fblocks\u002Fposts\u002Fslider\u002Fview.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbnm-blocks\u002F1.3.1\u002Fsrc\u002Fblocks\u002Fposts\u002Fslider\u002Fview.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbnm-blocks\u002F1.3.0\u002Fsrc\u002Fblocks\u002Fposts\u002Fslider\u002Fview.php\t2025-11-17 00:48:06.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fbnm-blocks\u002F1.3.1\u002Fsrc\u002Fblocks\u002Fposts\u002Fslider\u002Fview.php\t2026-04-07 17:20:44.000000000 +0000\n@@ -34,28 +34,30 @@\n \t$article_query = new WP_Query( $post_query_args );\n \n \t$slider_style = isset( $attributes['sliderStyle'] ) ? $attributes['sliderStyle'] : 'style-1';\n-\t$slides_per_view = isset( $attributes['slidesPerView'] ) ? $attributes['slidesPerView'] : 1;\n-\t$asepec_ratio = isset( $attributes['aspectRatio'] ) ? $attributes['aspectRatio'] : 0.5625;\n-\t$space_between_slides = isset( $attributes['spaceBetweenSlides'] ) ? $attributes['spaceBetweenSlides'] : 20;\n-\t$autoplay = isset( $attributes['autoplay'] ) ? $attributes['autoplay'] : false;\n+\t$slides_per_view = isset( $attributes['slidesPerView'] ) ? (int) $attributes['slidesPerView'] : 1;\n+\t$asepect_ratio = isset( $attributes['aspectRatio'] ) ? (float) $attributes['aspectRatio'] : 0.5625;\n+\t$space_between_slides = isset( $attributes['spaceBetweenSlides'] ) ? (int) $attributes['spaceBetweenSlides'] : 20;\n+\t$autoplay = isset( $attributes['autoplay'] ) ? (bool) $attributes['autoplay'] : false;\n \t$delay    = isset( $attributes['delay'] ) ? absint( $attributes['delay'] ) : 5;\n \t$featured_image_slug = ! empty( $attributes['featuredImageSizeSlug'] ) ? $attributes['featuredImageSizeSlug'] : '';\n \t$slider_thumb_size = ! empty( $attributes['slideThumbSize'] ) ? $attributes['slideThumbSize'] : '';\n \t$image_fit = ! empty( $attributes['imageFit'] ) ? $attributes['imageFit'] : 'cover';\n-\t$thumbSlidesPerView = isset( $attributes['thumbSlidesPerView'] ) ? $attributes['thumbSlidesPerView'] : 5;\n-\t$slide_image_class = \"image-fit-{$image_fit}\";\n+\t$thumbSlidesPerView = isset( $attributes['thumbSlidesPerView'] ) ? (int) $attributes['thumbSlidesPerView'] : 5;\n+\t$slide_image_class = sanitize_html_class( 'image-fit-'. $image_fit );\n@@ -205,13 +207,13 @@\n \t$slider_block = ob_get_clean();\n \n \t\u002F\u002F Slider style class name.\n-\t$slider_style_class = 'bnm-sw-' . $attributes['sliderStyle'];\n+\t$slider_style_class = sanitize_html_class( 'bnm-sw-' . $attributes['sliderStyle'] );\n \n \t$classes = array( 'wpbnmposw', 'bnmbcs', $slider_style_class );\n \n \tif ( $attributes['categoryBGColor'] || $attributes['categoryBGHoverColor'] || ! empty($attributes['categoryPadding']) ) {\n \t\t$classes[] = 'bnm-box-cat';\n \t}\n \n \tif ( $attributes['sectionHeaderStyle'] ) {\n-\t\t$classes[] = 'bnm-bhs-' . $attributes['sectionHeaderStyle'];\n+\t\t$classes[] = sanitize_html_class( 'bnm-bhs-' . $attributes['sectionHeaderStyle'] );\n \t}","The exploit requires an attacker with Author-level permissions. 1. Authenticate to the WordPress dashboard as an Author. 2. Create a new post or edit an existing one. 3. Insert a block belonging to the plugin, such as the 'Posts Slider' block (`bnm-blocks\u002Fposts-slider`). 4. Switch to the 'Code Editor' view in Gutenberg. 5. Locate the JSON comment for the block and inject an XSS payload into the 'sliderStyle' attribute (e.g., `\"sliderStyle\":\"\\\">\u003Cscript>alert(1)\u003C\u002Fscript>\"`). 6. Save and publish the post. 7. When any user views the post, the script will execute because the payload breaks out of the HTML class attribute and injects a script tag.","gemini-3-flash-preview","2026-04-16 16:28:42","2026-04-16 16:29:36",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.3.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbnm-blocks\u002Ftags\u002F1.3.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbnm-blocks.1.3.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbnm-blocks\u002Ftags\u002F1.3.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbnm-blocks.1.3.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbnm-blocks\u002Ftags"]