{
 "id": "WPSEC-2026-2821",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2821/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2821/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2821/index.md",
 "title": "GSlider Blocks <= 1.2.1 - Authenticated (Contributor+) CSS Injection via 'blockStyle' Block Attribute",
 "description": "The GSlider Blocks plugin for WordPress is vulnerable to CSS Injection via the 'blockStyle' block attribute in all versions up to, and including, 1.2.1, due to insufficient scoping of user-supplied CSS. Releases before 1.2.0 printed the attribute's CSS on the page without any selector scoping. From 1.2.0, a selector was accepted if it merely contained the block ID anywhere, and the block ID itself was not validated, so an empty block ID let every selector through. The same unscoped CSS was also returned in the plugin's REST API 'css' field. This makes it possible for authenticated attackers, with contributor-level access and above, to inject page-wide CSS rules that style elements outside the slider block. This could be used to deface pages, overlay content for UI redress attacks against site visitors, or exfiltrate page attribute values through attribute selectors with external url() requests.",
 "plugin": {
  "slug": "gslider-blocks",
  "name": "GSlider Blocks",
  "full_name": "GSlider Blocks",
  "wordpress_org": "https://wordpress.org/plugins/gslider-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/gslider-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/gslider-blocks"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.0,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.2.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.2.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.2.2",
 "remediation": "Update to 1.2.2 or later.",
 "fix_released": "2026-11-09T15:43:32+00:00",
 "published": "2026-11-10T15:48:02+00:00",
 "updated": "2026-11-09T23:34:19.577977+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2821/",
  "https://plugins.svn.wordpress.org/gslider-blocks/tags/1.2.2/",
  "https://wordpress.org/plugins/gslider-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/gslider-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-10"
 }
}