Vulnerability in Stackable – Page Builder Gutenberg Blocks — CVE-2026-9601

What to do now

Update Stackable – Page Builder Gutenberg Blocks to 3.19.10 or later.

Affected versions

• Everything up to and including 3.19.9

The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_block_style' endpoint in all versions up to, and including, 3.19.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

This description is reproduced verbatim from the public vulnerability record.

• https://github.com/gambitph/Stackable/pull/3725
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.php#L155
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.php#L181
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.php#L223
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.6/src/deprecated/block-defaults/custom-block-styles.php#L432
• https://plugins.trac.wordpress.org/browser/stackable-ultimate-gutenberg-blocks/tags/3.19.8/src/deprecated/block-defaults/custom-block-styles.php#L155

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.