medium6.8
CVE-2026-88993
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing us…
Impact
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
Affected products
| Product | Affected versions |
|---|---|
| All Bootstrap Blocks WordPress Plugin | through 1.3.31 |
Versions were read from the advisory text. No structured product data has been published for this record yet.