CVE-2026-9183

Name of the Vulnerable Software and Affected Versions 24liveblog versions prior to 2.3

Description The 24liveblog plugin for WordPress allows authenticated users with contributor-level access or higher to extract sensitive third-party account credentials. The issue occurs because the lb24 block enqueue scripts() function is hooked to enqueue block editor assets. For non-administrator users, the system loads site-wide integration secrets from the options table using get option() and exposes them via wp localize script() within the lb24BlockData JavaScript object. An attacker can retrieve the lb24 token, lb24 refresh token, lb24 uid, and lb24 uname variables by opening the block editor and inspecting the page source.

Recommendations Update the plugin to a version newer than 2.2. As a temporary workaround, restrict user roles to prevent non-administrator users from accessing the block editor.