CVE-2026-88993 is a Cross-Site Scripting (CWE-79) vulnerability in the All Bootstrap Blocks WordPress plugin through version 1.3.31. The vulnerability arises from improper escaping of a block attribute before it is output in the HTML tag-name position. This allows users with Contributor-level permissions or above to inject malicious scripts that execute in the context of users viewing the affected content.

An attacker with Contributor-level access or higher can inject arbitrary scripts that execute in the browsers of users who view the affected content. This can lead to session hijacking, defacement, or other script-based attacks depending on the injected payload. The vulnerability requires authenticated access at Contributor level or above, limiting exploitation to users with some level of trust on the site.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the All Bootstrap Blocks plugin if possible.