Description
The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.
Published: 2026-10-14
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-74
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.
Title Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-14T13:34:19.073Z

Reserved: 2026-09-24T11:27:35.308Z

Link: CVE-2026-97315

cve-icon Vulnrichment

Updated: 2026-10-14T10:43:23.597Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T11:17:09.100

Modified: 2026-10-14T16:14:02.800

Link: CVE-2026-97315

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T15:45:03Z

Weaknesses