CVE-2026-3498 is a stored cross-site scripting vulnerability in the BlockArt Blocks WordPress plugin, affecting all versions up to 2.2.15. The issue is caused by improper neutralization of input in the 'clientId' block attribute, allowing authenticated users with Author-level privileges or higher to inject arbitrary web scripts. These scripts execute when any user accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with network attack vector, low attack complexity, and privileges required at the Author level. No official fix or patch has been published yet.

An attacker with Author-level access or higher can exploit this vulnerability to inject malicious scripts into pages, which execute in the context of users viewing those pages. This can lead to partial confidentiality and integrity loss (e.g., theft of cookies or manipulation of page content). Availability is not impacted. The vulnerability requires authenticated access, limiting exposure to users with elevated permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and consider monitoring for suspicious activity related to script injection. Avoid granting unnecessary privileges to users. No official patch or temporary fix has been announced by the vendor at this time.