CVE-2026-0894 is a stored cross-site scripting vulnerability in the Content Blocks (Custom Post Widget) WordPress plugin, affecting all versions up to 3.3.9. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied content in the content_block shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute in the context of users viewing the compromised pages. This can lead to limited confidentiality and integrity impacts but does not affect availability. The CVSS 3.1 score is 6.4 (medium severity). No patch or official remediation has been published as of the data provided.

An attacker with contributor-level or higher privileges can inject malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the infected pages, potentially allowing theft of user credentials, session tokens, or other sensitive information. The impact is limited to confidentiality and integrity, with no direct availability impact. Since exploitation requires authenticated access, the risk is mitigated somewhat by access controls but remains significant in environments with multiple contributors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit contributor-level access to trusted users only. Avoid using the content_block shortcode with untrusted content. Monitor official vendor channels for updates and apply patches promptly once released.