PT-2026-84891

CVE-2026-84915

Published

2026-09-02

Updated

2026-10-22

Description by

CVSS 3.1

4.6

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Component blocks versions 0.0.0 through 1.2.7

Description Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently validate user input before passing it to token replacement. This issue requires the attacker to possess a role with permissions to edit Layout Builder layouts.

Recommendations Update Component blocks to a version later than 1.2.7.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-84915