{
 "id": "WPSEC-2026-2760",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2760/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2760/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2760/index.md",
 "title": "Flexible Table Block <= 3.9.0 - Authenticated (Contributor+) CSS Injection via Global Settings",
 "description": "The Flexible Table Block plugin for WordPress is vulnerable to Stored CSS Injection via the global settings (block_style options saved through the /flexible-table-block/v1/options REST route) in all versions up to, and including, 3.9.0. This is due to insufficient validation of the CSS values written into the plugin's inline <style> output: only '<' and '>' were rejected, so quotes and braces passed through, and parentheses inside quoted strings in functions such as calc(), var() or color functions could hide a closing brace from the safe-CSS check. This makes it possible for authenticated attackers with contributor-level access and above to break out of the generated table CSS rule and inject arbitrary CSS into pages that load the table block styles, which can be used to deface pages or overlay misleading content. Exploitation requires the non-default option that shows the global settings to non-administrators to be enabled.",
 "plugin": {
  "slug": "flexible-table-block",
  "name": "Flexible Table Block",
  "full_name": "Flexible Table Block",
  "wordpress_org": "https://wordpress.org/plugins/flexible-table-block/",
  "advisories_url": "https://wpsec.com/vuln/plugin/flexible-table-block/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/flexible-table-block"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-74"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.10.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.10.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.10.0",
 "remediation": "Update to 3.10.0 or later.",
 "fix_released": "2026-11-09T00:39:57+00:00",
 "published": "2026-11-10T00:41:31+00:00",
 "updated": "2026-11-09T23:33:54.236305+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2760/",
  "https://plugins.svn.wordpress.org/flexible-table-block/tags/3.10.0/",
  "https://wordpress.org/plugins/flexible-table-block/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/flexible-table-block",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}