CVE-2026-5711

Name of the Vulnerable Software and Affected Versions Post Blocks & Tools versions prior to 1.3.1

Description Stored Cross-Site Scripting occurs in the Posts Slider block due to insufficient input sanitization and output escaping of user-supplied attributes. Authenticated attackers with author-level access or higher can inject arbitrary web scripts via the sliderStyle block attribute. These scripts execute whenever a user visits a page containing the injected content.

Recommendations Update Post Blocks & Tools to version 1.3.1 or later. As a temporary mitigation, restrict access to the sliderStyle attribute in the Posts Slider block for users with author-level permissions.