{"schema":"threatline.record/2","record":{"id":"CVE-2026-110290","aliases":[],"summary":"WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute","details":"The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject instance_id) + undeclared is_widget' parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires setting the undeclared is_widget flag to '1' via block JSON, which activates the vulnerable code path that concatenates the attacker-controlled instance_id value into an unescaped HTML class attribute.","categories":["Unclassified"],"product":"WebberZone Top 10 — Popular Posts","vendor":"ajay","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110290","source_modified_at":"2026-10-16T14:39:03.035Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"WebberZone Top 10 — Popular Posts","vendor":"ajay","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.5.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00206,"percentile":0.10063,"score_date":"2026-10-23"},"published_at":"2026-10-16T06:41:03.815Z","modified_at":"2026-10-16T14:39:03.035Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110290","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T14:39:03.035Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110290","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4db4a201-a7fa-4764-87cb-c54b64adf560?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/top-10/tags/4.5.2/includes/frontend/class-display.php#L170"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/top-10/tags/4.5.2/includes/frontend/class-display.php#L153"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/top-10/tags/4.5.2/includes/util/class-helpers.php#L693"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/top-10/tags/4.5.2/includes/frontend/blocks/class-blocks.php#L142"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/top-10/tags/4.5.2/includes/frontend/blocks/class-blocks.php#L128"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3747022"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/top-10/tags/4.5.3/includes/frontend/class-display.php"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-16T14:34:06.246372Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T14:39:03.035Z","content_hash":"5ba9163f9d660522de8bffda1f3f315d9180fccf608e134dc3edea0a37e0fa69"}}