CVE-2025-26754: 
WordPress vulnerability analysis and mitigation

The Timeline Block WordPress plugin versions up to 1.1.1 contains a Cross-Site Scripting (XSS) vulnerability identified as CVE-2025-26754. The vulnerability was discovered by Logan Cote and reported on January 24, 2025. This security issue affects users with Contributor or higher privileges and allows for stored cross-site scripting attacks (Patchstack).

The vulnerability has been classified as a Cross-Site Scripting (XSS) issue with a CVSS score of 6.5, indicating a low to moderate severity level. It falls under the OWASP Top 10 category A3: Injection. The vulnerability requires Contributor-level privileges or higher to exploit (Patchstack).

If exploited, this vulnerability could allow malicious actors to inject harmful scripts, including redirects and unwanted advertisements, into the affected website. These malicious payloads would be executed when visitors access the compromised site (Patchstack).

The vulnerability has been patched in version 1.1.3 of the Timeline Block plugin. Users are advised to update to version 1.1.3 or later to remediate the security issue. For additional protection, Patchstack users can enable auto-update functionality for vulnerable plugins (Patchstack).