CVE-2026-92396
Blocks for ShopEngine < 2.4.4 - Contributor+ Stored XSS via gutenova_store_css
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.
| Vendor | unknown |
| Product | shopengine gutenberg woocommerce builder blocks addon |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown shopengine gutenberg woocommerce builder blocks addon
Be the first to know when new unknown vulnerabilities affecting unknown shopengine gutenberg woocommerce builder blocks addon are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / ShopEngine Gutenberg WooCommerce Builder Blocks Addon
0 < 2.4.4
References
Credits
JunHee CHO WPScan