Vulnerability · Published Aug 9, 2026 · Assigned by WPScan
CVE-2026-17011Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection
Low 3.8
In plain English
A low-severity insufficient verification of data authenticity in Nexter Blocks from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)3.8Low
Exploit odds (30 days)0.2%top 93.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Nexter Blocks | 0 – before 5.0.2 |
Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
References
- https://wpscan.com/vulnerability/a702e5cb-0fb3-419e-81df-fa5b26c81402/ exploit, vdb-entry, technical-description