What is GHSA-6wqp-7cwm-r4gv?

GHSA-6wqp-7cwm-r4gv is a security advisory published by GitHub Security Advisories with High severity. The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text...

Which CVE IDs does GHSA-6wqp-7cwm-r4gv cover?

GHSA-6wqp-7cwm-r4gv covers the following CVE IDs: CVE-2026-16623. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6wqp-7cwm-r4gv?

GHSA-6wqp-7cwm-r4gv has a CVSS v3 base score of 8.0, published by GitHub Security Advisories.

GHSA-6wqp-7cwm-r4gvHighCVSS 8.0

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text...

Vendor

GitHub Security Advisories

Published

August 4, 2026

Last Modified

August 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-16623 →

📋 Description

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16623
https://wpscan.com/vulnerability/19c7fdaa-5e75-481d-884c-68fdb2fb8f8d
https://github.com/advisories/GHSA-6wqp-7cwm-r4gv