CVE-2026-94118 is a CWE-79 cross-site scripting vulnerability in the Premium Blocks – Gutenberg Blocks for WordPress plugin by Leap13. It affects versions up to and including 2.3.17. The flaw arises from improper neutralization of input during web page generation, enabling contributor-level users to inject and execute malicious scripts in the context of other users. The CVSS v3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges at the contributor level, user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or fix information is provided, and no known exploits in the wild have been reported.

An attacker with contributor privileges can exploit this vulnerability to perform cross-site scripting attacks, potentially leading to unauthorized script execution in the context of other users. This can result in partial compromise of confidentiality, integrity, and availability of the affected WordPress site. The impact is rated medium based on the CVSS score of 6.5.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider additional input validation or sanitization measures if possible.