CVE-2026-88993

Name of the Vulnerable Software and Affected Versions All Bootstrap Blocks versions prior to 1.3.32

Description The All Bootstrap Blocks WordPress plugin fails to properly escape a block attribute before outputting it in an HTML tag-name position. This allows users with Contributor-level access and above to perform a Stored Cross-Site Scripting (XSS) attack by injecting arbitrary web scripts via the type attribute of the areoi/button block. These scripts execute when the affected content is viewed.

Recommendations Update the plugin to version 1.3.32 or later. As a temporary mitigation, restrict users with Contributor-level access from editing blocks or avoid using the type attribute in the areoi/button block.