CVE-2026-8981: Unknown Custom Block Builder

Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.

Affected products

• Unknown Custom Block Builder: before 4.3.0 (fixed in 4.3.0)

Published 2026-06-09. Last modified 2026-07-23.