Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-39575 EUVD-2026-20223GHSA-2mw3-cgxq-9prq

WordPress Custom Query Blocks plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerability

Published Apr 8, 2026 · Updated Apr 29, 2026 · Assigned by Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through <= 5.5.0.

Affected products

VendorProductAffectedFixed
Ronald Huereca Custom Query Blocks ≤ 5.5.0 —

References