CVE-2026-1093

Name of the Vulnerable Software and Affected Versions WPFAQBlock– FAQ & Accordion Plugin For Gutenberg versions up to and including 1.1

Description The WPFAQBlock– FAQ & Accordion Plugin For Gutenberg plugin for WordPress has a stored cross-site scripting issue. The issue is due to insufficient input sanitization and output escaping on user-supplied attributes in the class parameter of the wpfaqblock shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

Recommendations Update WPFAQBlock– FAQ & Accordion Plugin For Gutenberg to a version later than 1.1.