bPlugins B Blocks: Stored Cross-Site Scripting in WordPress plugin

Summary

The bPlugins B Blocks plugin for WordPress up to version 2.1.15 contains a stored Cross-Site Scripting (XSS) flaw (CWE-79). An authenticated low-privilege user, such as a Contributor, can store malicious script that runs in the browser of another user who views the affected content. Successful exploitation requires a privileged user to interact, for example by opening a crafted page or clicking a malicious link, and could allow theft of visitor data or account hijacking.

Affected

• bPlugins B Blocks (WordPress plugin) from n/a through 2.1.15

Fixed in

• Update to version 2.1.16 or later (per Patchstack and OffSeq; 2.1.16 is not independently confirmed by the vendor or the WordPress.org changelog)

Workaround

• Not applicable once the plugin is updated.
• Deactivate the plugin on sites where it is not essential.
• Restrict Contributor and Author accounts to trusted users.
• Have an editor review content containing plugin blocks before publishing.
• No vendor-issued workaround found.

Exploitation

• OffSeq reports public disclosure with evidence found, but no detectable or weaponized activity on record.
• Not listed in CISA KEV.
• No public proof of concept or active exploitation confirmed at the time of writing.

Our recommendation

• Check whether the B Blocks plugin is installed and which version is active.
• Update to the newest available version and verify the changelog for an XSS fix.
• If an update is not possible right away, deactivate the plugin or restrict Contributor and Author accounts.
• Prioritise multi-author sites and sites where administrators log in from less-trusted devices.
• Monitor for unexpected scripts or content changes on the website.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory CVE-2026-125451 patchstack.com
• OffSeq Radar CVE-2026-125451 radar.offseq.com
• Strix CVE-2026-125451 www.strix.ai
• WordPress.org plugin page B Blocks wordpress.org
• Wordfence threat intel B Blocks www.wordfence.com
• VulDB CVE-2026-104400 (earlier B Blocks XSS) vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:38.