Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T09:16:42.707Z",
  "pubdate": "2026-10-12T09:16:42.707Z",
  "executiveSummary": "The vulnerability is identified as an Improper Neutralization of Input During Web Page Generation, commonly referred to as Stored Cross-Site Scripting (XSS).\nThis flaw resides in the 'post-type-archive-mapping' functionality within the DLX Plugins Custom Query Blocks product, affecting all versions from n/a through 5.6.0.\nThe vulnerability allows a remote, authenticated attacker to inject arbitrary malicious JavaScript into the application's database via the vulnerable input vector.\nWhen rendered, this script executes within the context of the victim's browser session, leading to unauthorized actions, potential session hijacking, or data theft.\nThe risk is categorized as high, as successful exploitation does not require advanced technical skills from the attacker once access to the vulnerable input field is obtained.\nNo specific mention of remote code execution or server-side compromise is provided; however, the client-side impact is significant for administrative users viewing the injected content.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Custom Query Blocks plugin to adequately sanitize or escape user-supplied input before storing it in the WordPress database and subsequently rendering it within the administrative interface or frontend.\nSpecifically, the 'post-type-archive-mapping' component does not implement sufficient input validation or output encoding mechanisms to prevent the injection of executable scripts.\nThe exploitation flow begins with an attacker authenticated to the WordPress dashboard accessing the configuration settings for 'post-type-archive-mapping'. The attacker inserts a malicious payload, such as a script tag containing arbitrary JavaScript, into the input fields intended for mapping configurations.\nBecause the plugin fails to perform server-side sanitization, the payload is persisted into the database in its raw, unencoded format.\nThe vulnerability is triggered when a user, typically an administrator or a user with similar privileges who manages the plugin, navigates to the administrative page where these mapping configurations are displayed or rendered.\nAs the browser parses the HTML response, the browser interprets the attacker's stored payload as part of the document structure, thereby executing the injected JavaScript within the context of the user's active session.\nThis behavior facilitates a Stored XSS attack, where the impact is persistent across multiple views until the malicious payload is manually removed from the database.\nPost-exploitation impact includes the ability to perform actions on behalf of the victim, such as modifying plugin settings, creating new administrative accounts, redirecting the user to malicious external sites, or capturing sensitive session cookies to facilitate account takeover.\nThe vulnerability affects all versions of Custom Query Blocks up to and including 5.6.0. Since the flaw is rooted in the input handling logic of the plugin, the network exposure is strictly tied to the accessibility of the administrative interface where the malicious input can be saved.\nNo specific authentication bypass is required to reach the injection point; however, the attacker must possess the necessary privileges to modify the plugin's configuration settings."
}