CVE-2026-94632

Executive Summary

CVE-2026-94632 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "BlockStrap Page Builder - Bootstrap Blocks," maintained by Stiofan, affecting all versions through 0.1.58. The flaw arises from improper neutralization of user-supplied input during web page generation (CWE-79). Because exploitation requires user interaction (UI:R) but no authentication (PR:N), any unauthenticated attacker who can lure a victim to a crafted URL can execute script in that victim's browser session within the context of the affected WordPress site. With a CVSS base score of 7.1 (High), the vulnerability's scope change (S:C) elevates the impact beyond the originating component to the broader site and any authenticated session of the victim.

Technical Analysis

The vulnerability is classified under CWE-79 — Improper Neutralization of Input During Web Page Generation, rendered in its reflected variant. Reflected XSS occurs when an application incorporates attacker-controlled data into an HTTP response without adequate output encoding, and that response is delivered to the victim during a single request/response cycle. Unlike stored XSS, the malicious payload is not persisted server-side; it is carried in the crafted request and "bounced" back to the victim's browser.

For this plugin instance, the specific vulnerable parameter, endpoint, or template is not disclosed in the available NVD description or CNA title. Per the accuracy constraints of this report, no function names, parameter names, API routes, or file paths have been fabricated. The following analysis reflects what is derivable from the CNA/NVD data:

• Attack surface: The plugin is a page-builder component for WordPress (BlockStrap Page Builder, distributed as the "blockstrap-page-builder-blocks" slug). Page builders typically expose front-end rendering endpoints and/or admin-ajax style handlers that reflect URL-derived parameters into generated markup. The vulnerability resides in one of these web page generation paths.
• Mechanism: User input is echoed into an HTML page without HTML-entity encoding (or without encoding appropriate to the output context), allowing an attacker to break out of the intended content context and inject script tags or event-handler attributes.
• Root cause: Missing or insufficient context-aware output encoding and/or lack of input validation of reflected parameters during page generation.
• Precondition: None for the attacker's request (PR:N), but the exploit completes only when a victim with an active session visits the crafted URL (UI:R).

The CVSS vector (AV:N, AC:L, PR:N, UI:R, S:C, C:L/I:L/A:L) indicates: remotely reachable, low complexity, no privileges required, requires victim interaction, and demonstrated impact to confidentiality, integrity, and availability of the affected scope that is Low, with the vulnerable component's failure impacting resources beyond its security scope (S:C). This scope change is typical of XSS where script execution occurs in the browser context of the victim's authenticated session, granting access to cookies, tokens, and admin functionality of the broader WordPress installation.

Note: No public proof-of-concept, Nuclei template, or exploit code is known for CVE-2026-94632. The attack chain below is inferred from the vulnerability class (Reflected XSS) and the CVSS metrics, not from a published exploit.

Exploitation Scenarios

Because no public PoC exists, the following reconstruction is derived at the vulnerability-class level consistent with CWE-79 and the stated CVSS vector. It deliberately avoids naming parameters, endpoints, or files not confirmed in the source intelligence.

1. Reconnaissance / Target Identification

• Identify WordPress sites running the BlockStrap Page Builder - Bootstrap Blocks plugin, version 0.1.58 or earlier.
• Fingerprint via plugin asset paths served under the standard WordPress plugin directory (the blockstrap-page-builder-blocks slug) and/or HTML artifacts associated with the builder's rendered pages.
• Confirm the WordPress REST/AJAX or front-end rendering endpoints respond to the site's reflected input paths. Because the exact vulnerable parameter is undisclosed, an attacker would enumerate common reflected-input surfaces of the plugin (query strings rendered into builder output).

2. Triggering the Flaw Class

• Reflected XSS is triggered by crafting a URL that carries a payload into a parameter which the plugin reflects into the generated HTML without neutralization.
• The attacker must determine which reflected value is output unsafely and which HTML context it lands in (text node, attribute, JavaScript string, URL) to build a context-appropriate payload.

3. Payload / Execution Method

• At the class level, the payload is an HTML/JavaScript injection that survives to the victim's browser and executes in the origin of the WordPress site.
• Delivery is via a link (email, chat, forum, malvertising, or social engineering) that the victim clicks while logged in or browsing the site. CWE-79 reflected variants commonly use payloads such as injected script elements or event-handler attributes, but no specific known payload exists for this CVE.

4. Post-Exploitation Impact

• Executed script runs in the victim's browser within the site's security scope (S:C). Typical outcomes:
  • Session/cookie or token theft leading to account takeover (especially administrator sessions).
  • Forced authenticated actions on behalf of the victim (CSRF-style abuse of admin functionality).
  • Malicious script injection, redirects, or credential phishing overlays hosted in-site.
  • Because the plugin is a page builder, compromise could be leveraged to inject content or scripts into pages subsequently rendered to other users — though the reflected variant alone does not persist server-side.

Impact Assessment

• CVSS Base Score: 7.1 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.
• Attack Vector (N): Exploitation over the network; no local access needed.
• Attack Complexity (L): No special conditions beyond victim interaction.
• Privileges Required (N): The attacker needs no account on the target.
• User Interaction (R): The victim must visit the crafted URL / interact.
• Scope (C): The vulnerability of the plugin affects resources beyond itself — the browser session of the site origin, allowing leverage against the wider WordPress application.
• Confidentiality (L)/Integrity (L)/Availability (L): Each individually Low, but combined and amplifed by scope change to a substantial overall risk.
• Blast radius: Any WordPress site running the affected plugin version, including sites using it to build public-facing pages. High-value targets are sites with privileged user sessions (admins, editors) exposed to lure links.
• Business impact: Potential account takeover, defacement, content/script injection, credential theft, and downstream reputational and regulatory consequences. As an unpatched vulnerability (confidence 0/4), exposure persists until the plugin is removed, disabled, or a vendor fix is released.
• EPSS: Not yet scored by FIRST.org — no probability estimate is available; do not assume low likelihood solely from the absence of an EPSS value.

Detection Guidance

Sigma Rule

title: Reflected XSS Attempt in BlockStrap Page Builder - Bootstrap Blocks (CVE-2026-94632)
id: 8f2c1a74-5b3e-4d9f-9a21-7c6e0d4b1f33
status: experimental
description: Detects HTTP requests containing common reflected XSS payload indicators targeting WordPress sites running the vulnerable BlockStrap Page Builder plugin (<= 0.1.58).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94632
author: valtersit.com
date: 2026-01-01
tags:
  - attack.initial_access
  - attack.t1190
  - cwe.79
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method: 'GET'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - 'document.cookie'
      - 'svg/onload'
  selection_plugin:
    cs-uri-stem|contains:
      - 'blockstrap-page-builder-blocks'
  condition: selection_method and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Security scanners and fuzzing tools
  - Legitimate application input containing HTML-like text
level: high

YARA Rule

rule CVE_2026_94632_Reflected_XSS_BlockStrap
{
    meta:
        description = "Detects reflected XSS indicators in HTTP request logs/files targeting BlockStrap Page Builder - Bootstrap Blocks (CVE-2026-94632)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94632"
        date = "2026-01-01"
        cwe = "CWE-79"

    strings:
        $plugin1 = "blockstrap-page-builder-blocks" ascii nocase
        $plugin2 = "BlockStrap" ascii nocase

        $xss1 = "<script" ascii nocase
        $xss2 = "%3Cscript" ascii nocase
        $xss3 = "onerror=" ascii nocase
        $xss4 = "onload=" ascii nocase
        $xss5 = "javascript:" ascii nocase
        $xss6 = "document.cookie" ascii nocase
        $xss7 = "alert(" ascii nocase

    condition:
        $plugin1 or $plugin2 and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94632 Reflected XSS attempt in BlockStrap Page Builder - Bootstrap Blocks"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"blockstrap-page-builder-blocks"; nocase; http.uri; content:"<script"; nocase; http.uri; content:"onerror="; nocase; classtype:web-application-attack; reference:cve,2026-94632; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94632; sid:202694632; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method == "GET" and
      url.path : "*blockstrap-page-builder-blocks*" ]
  [ network where http.request.method == "GET" and
      (url.query : "*<script*" or
       url.query : "*onerror=*" or
       url.query : "*onload=*" or
       url.query : "*javascript:*" or
       url.query : "*document.cookie*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
(uri_path="*blockstrap-page-builder-blocks*" OR cs_uri_stem="*blockstrap-page-builder-blocks*")
(uri_query="*<script*" OR uri_query="*onerror=*" OR uri_query="*onload=*" OR uri_query="*javascript:*" OR uri_query="*document.cookie*" OR cs_uri_query="*%3Cscript*")
| eval indicator=case(
    match(uri_query, "(?i)<script|<script|%3Cscript"), "script_tag",
    match(uri_query, "(?i)onerror=|onload=|javascript:"), "event_handler",
    true(), "other")
| stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators by src_ip, uri_path, uri_query, useragent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-94632,">
  <rule id="100946" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>blockstrap-page-builder-blocks</url>
    <match>script|onerror=|onload=|javascript:|document.cookie|%3Cscript</match>
    <description>CVE-2026-94632: Possible reflected XSS attempt against BlockStrap Page Builder - Bootstrap Blocks from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,xss,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Remove or deactivate the BlockStrap Page Builder - Bootstrap Blocks plugin (all versions <= 0.1.58) from any WordPress installation where it is not strictly required. Deactivation removes the vulnerable code path from being reachable by an attacker.
• If the plugin cannot be removed, place it behind a Web Application Firewall (WAF) with virtual patching rules for reflected-XSS patterns targeting the plugin's reflected-input surfaces. WAF rules reduce but do not eliminate risk.
• Restrict exposure: reduce the number of privileged sessions (e.g., admins) that browse untrusted links while logged into the affected site; enforce session re-authentication for admin actions.
• Apply conservative browser hardening: ensure HttpOnly and SameSite cookie attributes are set on WordPress session cookies to limit token theft via injected script.

2. Patch / upgrade steps

• No vendor patch is currently confirmed. Monitor the plugin's distribution channel and the vendor's advisories for a fixed release above 0.1.58. Until a fix is released, treat every version through 0.1.58 as vulnerable.
• Track the NVD entry (CVE-2026-94632) for updated references, CNA advisory, and any vendor patch notice.
• Verify plugin integrity before reinstalling from any source; do not install unofficial or repackaged builds.

3. Long-term hardening

• Implement context-aware output encoding across all custom and third-party WordPress components; enforce a secure development lifecycle requiring HTML/attribute/JavaScript/URL-context escaping on any reflected input.
• Adopt a Content Security Policy (CSP) that disallows inline script and restricts script-src to trusted origins — this substantially reduces reflected-XSS exploitability.
• Maintain a software asset inventory and continuously track plugin versions; remove unused page-builder or plugin components to reduce attack surface.
• Enforce least privilege for WordPress roles; administrators should not routinely browse untrusted URLs using privileged sessions.
• Deploy a WAF with regularly updated virtual patching as a compensating control while upstream patches are pending.

References

• NVD — CVE-2026-94632: https://nvd.nist.gov/vuln/detail/CVE-2026-94632
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') — https://cwe.mitre.org/data/definitions/79.html
• FIRST EPSS — no score available at time of writing; consult https://www.first.org/epss/ for future scoring.
• CISA Known Exploited Vulnerabilities Catalog — no entry for CVE-2026-94632 at time of writing: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Vendor/plugin distribution channel for BlockStrap Page Builder - Bootstrap Blocks — monitor for fixed versions above 0.1.58 (no advisory URL confirmed in available intelligence).

Threat actor campaigns / exploit-in-the-wild: None identified. No public PoC, exploit code, or Nuclei template is known for CVE-2026-94632. Given the unpatched status and absence of an EPSS score, exploit development and in-the-wild use should be assumed possible; detection and mitigation rules above should be deployed proactively rather than reactively.