CVE-2026-6247

Name of the Vulnerable Software and Affected Versions scratchblocks for WP versions prior to 1.0.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages via the element attribute of the scratchblocks shortcode. These scripts execute whenever a user accesses the affected page.

Recommendations Update scratchblocks for WP to version 1.0.2 or later. As a temporary mitigation, restrict the use of the element attribute within the scratchblocks shortcode for users with contributor-level access.