Custom Blocks Constructor – Lazy Blocks, CVE-2026-8981

CVE, Research URL: CVE-2026-8981
Home page URL: Security reports for Custom Blocks Constructor – Lazy Blocks
Application: Custom Blocks Constructor – Lazy Blocks
Published on: Jun 09, 2026
Research Description: The Custom Block Builder WordPress plugin before 4.3.0 does not consistently check the unfiltered_html capability across all paths that write to its block template code fields, allowing administrators on multisite installations (or single-site installs with DISALLOW_UNFILTERED_HTML defined) to inject arbitrary JavaScript that executes for any visitor of pages embedding the affected block.
Affected versions: max 4.3.0.
Status: vulnerable

Custom Blocks Constructor &#8211; Lazy Blocks, CVE-2026-8981