CVE-2026-4125 is a stored cross-site scripting vulnerability in the WPMK Block WordPress plugin affecting all versions up to and including 1.0.1. The issue arises in the wpmk_block_shortcode() function where the 'class' shortcode attribute is extracted from user input and directly concatenated into an HTML div element's class attribute without proper escaping (e.g., esc_attr()). This improper neutralization of input allows authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity) with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject and store malicious scripts within pages using the vulnerable shortcode. These scripts execute in the browsers of users who view the infected pages, potentially leading to session hijacking, defacement, or other script-based attacks. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known active exploits in the wild.

Patch status is not yet confirmed — no official fix or update has been published by the vendor. Until a patch is available, administrators should restrict Contributor-level access to trusted users only and consider disabling or removing the WPMK Block plugin if possible. Monitor vendor advisories for updates and apply official patches promptly once released.