CVE-2026-17011
Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.
| Vendor | unknown |
| Product | nexter blocks |
| Published | Aug 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown nexter blocks
Be the first to know when new unknown vulnerabilities affecting unknown nexter blocks are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Nexter Blocks
0 < 5.0.2
References
Credits
Vaibhav Narkhede WPScan