What is GHSA-prx4-2899-p4c2?

GHSA-prx4-2899-p4c2 is a security advisory published by GitHub Security Advisories with Medium severity. The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not...

Which CVE IDs does GHSA-prx4-2899-p4c2 cover?

GHSA-prx4-2899-p4c2 covers the following CVE IDs: CVE-2026-92396. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-prx4-2899-p4c2?

GHSA-prx4-2899-p4c2 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-prx4-2899-p4c2MediumCVSS 6.8

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not...

Vendor

GitHub Security Advisories

Published

November 6, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-92396 →

📋 Description

The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-92396
https://wpscan.com/vulnerability/f7db6391-4873-4de9-b300-456f3c9b7146
https://github.com/advisories/GHSA-prx4-2899-p4c2