CVE-2026-24528: 
WordPress vulnerability analysis and mitigation

CVE-2026-24528 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the pixelgrade Nova Blocks WordPress plugin. It affects all versions of Nova Blocks through 2.1.9, with version 2.1.10 being the patched release. The vulnerability was reported on December 27, 2025, published by Patchstack on January 23, 2026, and received a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, malicious input is processed and reflected within the browser's Document Object Model without proper sanitization, allowing injected scripts to execute in the victim's browser context. Exploitation requires the attacker to have at least Contributor-level privileges on the WordPress site, and successful exploitation additionally requires a privileged user to interact with a crafted payload (e.g., clicking a malicious link or visiting a crafted page) (Patchstack).

Successful exploitation allows an attacker to inject and execute malicious JavaScript in the browsers of site visitors or administrators, potentially enabling session hijacking, credential theft, unauthorized actions on behalf of the victim, or redirection to malicious sites. The scope is changed (S:C), meaning the impact can extend beyond the vulnerable component to affect other resources in the browser context. Confidentiality, integrity, and availability impacts are each rated Low, limiting the severity but still posing meaningful risk in mass-exploit scenarios targeting WordPress sites (Patchstack).

There is no public evidence of active in-the-wild exploitation or known exploit kits targeting this vulnerability at this time. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns against WordPress sites, though this specific CVE is rated low priority (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Nova Blocks plugin at version 2.1.9 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Obtain Contributor access: Register or compromise a Contributor-level (or higher) account on the target WordPress site, as this privilege level is required to inject content via the plugin.
3. Craft malicious payload: Create a Nova Blocks-powered page or post containing a DOM-Based XSS payload embedded in a plugin block parameter that is not properly sanitized before being rendered in the DOM.
4. Deliver payload to victim: Share or link the crafted page to a privileged user (e.g., administrator) or wait for site visitors to load the page containing the injected script.
5. Execute malicious script: When the victim's browser renders the page, the injected JavaScript executes in their browser context, enabling session token theft, credential harvesting, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing unusual POST or GET requests to pages containing Nova Blocks content with encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload= patterns in request parameters.
• File System: Unexpected modifications to Nova Blocks plugin files or WordPress theme files that may indicate post-exploitation tampering.
• Network: Outbound requests from victim browsers to unknown external domains following interaction with Nova Blocks-rendered pages, potentially indicating data exfiltration via XSS.
• Browser/Application: Reports from users of unexpected redirects, pop-ups, or unauthorized actions occurring after visiting specific WordPress pages using the Nova Blocks plugin.

The primary remediation is to update the Nova Blocks plugin to version 2.1.10 or later, which contains the fix for this vulnerability (Patchstack). Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically. If an immediate update is not possible, site administrators should restrict Contributor-level user registrations and review existing Contributor accounts for suspicious activity as a temporary risk-reduction measure.

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering January 26 to February 1, 2026, highlighting it as part of broader WordPress plugin security tracking. Patchstack, which discovered and disclosed the vulnerability (credited to researcher theviper17), classifies it as low priority with no significant immediate threat. No notable broader media coverage or significant community discussion has been identified beyond standard vulnerability database reporting.