CVE-2026-75016

Name of the Vulnerable Software and Affected Versions Magazine Blocks versions prior to 1.8.7

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the NewsTicker::render() function. The clientId attribute of the News Ticker block is concatenated into an HTML class attribute without the use of esc attr(), allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when a user visits the affected page.

Recommendations Update the plugin to a version later than 1.8.6. As a temporary mitigation, restrict access to the News Ticker block for users with contributor-level permissions.