# Flexible Table Block <= 3.9.0 - Authenticated (Contributor+) CSS Injection via Global Settings

- **ID:** WPSEC-2026-2760
- **Plugin:** Flexible Table Block (`flexible-table-block`), https://wordpress.org/plugins/flexible-table-block/
- **Affected versions:** all versions before 3.10.0
- **Fixed in:** 3.10.0 (Update to 3.10.0 or later.)
- **Severity:** Medium 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/flexible-table-block
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2760/

## Description

The Flexible Table Block plugin for WordPress is vulnerable to Stored CSS Injection via the global settings (block_style options saved through the /flexible-table-block/v1/options REST route) in all versions up to, and including, 3.9.0. This is due to insufficient validation of the CSS values written into the plugin's inline <style> output: only '<' and '>' were rejected, so quotes and braces passed through, and parentheses inside quoted strings in functions such as calc(), var() or color functions could hide a closing brace from the safe-CSS check. This makes it possible for authenticated attackers with contributor-level access and above to break out of the generated table CSS rule and inject arbitrary CSS into pages that load the table block styles, which can be used to deface pages or overlay misleading content. Exploitation requires the non-default option that shows the global settings to non-administrators to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2760/
- https://plugins.svn.wordpress.org/flexible-table-block/tags/3.10.0/
- https://wordpress.org/plugins/flexible-table-block/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2760/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.