CVE-2026-2583

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `blocksy_meta` metadata fields in all versions up to, and including, 2.1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-258323.7In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.CVE-2026-258337.5Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function CVE-2026-258346.5Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.CVE-2026-258357.7Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).CVE-2026-258367.2An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5 CVE-2026-25849.3A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthenticated, remote att CVE-2026-258466.5In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs CVE-2026-258476.1In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible CVE-2026-258489.8In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible CVE-2026-25856.4The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all version CVE-2026-258505.5in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak CVE-2026-258519.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate