CVE-2026-8981 is a CWE-79 Cross-Site Scripting vulnerability in the Custom Block Builder WordPress plugin versions prior to 4.3.0. The issue arises from inconsistent checks of the unfiltered_html capability across all code paths that write to block template code fields. This allows administrators on multisite WordPress installations, or single-site installs with the DISALLOW_UNFILTERED_HTML constant defined, to inject arbitrary JavaScript code. This code executes in the context of any visitor loading pages embedding the affected block, potentially leading to client-side script execution. The vulnerability is rated with a CVSS 3.1 base score of 3.5 (low severity). No official patch or remediation level has been published yet, and no known exploits have been reported.

The vulnerability allows administrators with certain capabilities on multisite or restricted single-site WordPress installations to inject arbitrary JavaScript into block template code fields. This script executes in the browsers of visitors to pages containing the affected block, potentially leading to client-side script execution. The impact is limited to low severity with partial confidentiality and integrity impact, no availability impact, and requires administrator privileges and user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should be cautious when managing block template code fields and consider restricting administrative access. Monitoring for plugin updates and applying them promptly once available is recommended.