CVE-2026-1646 is a stored cross-site scripting vulnerability in the Advance Block Extend WordPress plugin, specifically affecting the TitleColor attribute in the Latest Posts Gutenberg block. The flaw allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code due to improper neutralization of input during web page generation. This vulnerability can lead to script execution in the context of users viewing the injected content, potentially compromising confidentiality and integrity. The vulnerability affects all versions up to and including 1.0.4. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the level of a contributor, no user interaction, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to unauthorized disclosure of information or manipulation of content. There is no indication of availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level access to trusted users only and consider disabling or removing the Advance Block Extend plugin if possible. Monitor vendor channels for updates or patches addressing this vulnerability.