CVE-2026-108168

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers with low privileges can inject malicious scripts into pages viewed by other users. This allows execution of arbitrary JavaScript in the context of victims' sessions, potentially hijacking admin accounts if clicked.

Root cause

The plugin fails to sanitize and neutralize user-supplied input before rendering it in web pages, leading to stored cross-site scripting.

Affected systems

DLX Plugins Custom Query Blocks (post-type-archive-mapping) up through version 5.6.0.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Fix & remediation

Upgrade to a version newer than 5.6.0 if available; otherwise, deactivate the plugin immediately via the WordPress admin dashboard or CLI.

shell

$ wp plugin deactivate post-type-archive-mapping

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.

References

https://patchstack.com/database/wordpress/plugin/post-type-archive-mapping/vulnerability/wordpress-custom-query-blocks-plugin-5-6-0-cross-site-scripting-xss-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-108168