{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4125", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-13T13:47:13.693Z", "datePublished": "2026-04-22T07:45:36.110Z", "dateUpdated": "2026-04-22T07:45:36.110Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T07:45:36.110Z"}, "affected": [{"vendor": "wpmkorg", "product": "WPMK Block", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPMK Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, in the wpmk_block_shortcode() function, the 'class' attribute is extracted from user-controllable shortcode attributes and directly concatenated into an HTML div element's class attribute without any escaping (e.g., esc_attr()). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WPMK Block <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e397c7a-2aef-4c23-a224-e324ea4bb4b1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpmk-block/trunk/classes/wpmk-block-class.php#L97"}, {"url": "https://plugins.trac.wordpress.org/browser/wpmk-block/tags/1.0.1/classes/wpmk-block-class.php#L97"}, {"url": "https://plugins.trac.wordpress.org/browser/wpmk-block/trunk/classes/wpmk-block-class.php#L82"}, {"url": "https://plugins.trac.wordpress.org/browser/wpmk-block/tags/1.0.1/classes/wpmk-block-class.php#L82"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "timeline": [{"time": "2026-04-21T19:05:22.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WPMK Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, in the wpmk_block_shortcode() function, the 'class' attribute is extracted from user-controllable shortcode attributes and directly concatenated into an HTML div element's class attribute without any escaping (e.g., esc_attr()). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-4125", "lastModified": "2026-04-22T09:16:23.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-22T09:16:23.633", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpmk-block/tags/1.0.1/classes/wpmk-block-class.php#L82"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpmk-block/tags/1.0.1/classes/wpmk-block-class.php#L97"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpmk-block/trunk/classes/wpmk-block-class.php#L82"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpmk-block/trunk/classes/wpmk-block-class.php#L97"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e397c7a-2aef-4c23-a224-e324ea4bb4b1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T09:25:40.942066+00:00", "value": {"mitigation_remediation": ["Update the WPMK Block plugin to the latest version (1.0.2 or newer) that includes proper sanitization and escaping for the class attribute.", "If an immediate upgrade is not possible, edit or remove the shortcode instances that use the class attribute from existing content, or replace the class value with hard\u2011coded safe strings that do not contain user input.", "As a temporary protective measure, configure a Content Security Policy that disallows inline scripts to reduce the impact of any residual XSS payloads."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the WPMK Block plugin installed in any version up to and including 1.0.1 are affected. Administrators should verify the installed plugin version; any site running version 1.0.1 or earlier is vulnerable. The plugin is maintained by wpmkorg under the WPMK Block product name.", "description_and_impact": "The WPMK Block plugin fails to sanitize or escape the value of the class shortcode attribute before inserting it into a div element\u2019s class attribute. This flaw allows an authenticated user with at least Contributor privileges to embed arbitrary JavaScript within the content that is stored in the database. When a page containing the malicious shortcode is viewed, the injected script executes in the context of the site, potentially granting the attacker access to user session data, enabling credential theft, or defacing the site. The weakness aligns with CWE\u201179, a classic unsanitized input leading to XSS.", "risk_and_exploitability": "The flaw is a stored XSS that requires only Contributor level access, a common role on many WordPress sites, making the attack vector fairly wide. The CVSS score of 6.4 indicates a moderate to high severity. The EPSS score is not available, so exploitation likelihood is unclear, but the lack of a published exploit and absence from the CISA KEV catalog suggest lower current exploitation risk. Nonetheless, an attacker could remotely inject malicious scripts that execute for any user who visits the affected pages, so the risk of confidentiality and integrity compromise remains significant."}}}}, "created": "2026-04-22T09:30:13.554879+00:00", "updated": "2026-04-22T09:30:13.554889+00:00", "vendors": []}