CVE-2026-118800

Name of the Vulnerable Software and Affected Versions aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder versions prior to 2.18.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages via the headingTag parameter. These scripts execute whenever a user accesses the affected page.

Recommendations Update aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder to version 2.18.1 or later. Avoid using the headingTag parameter until the update is applied.