CVE-2026-17011
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Aug 09, 2026
Vendor
unknown
Description
The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing.