CVE-2026-108168 DLX Plugins CVE debrief

Who should care

Defenders managing WordPress environments with the Custom Query Blocks plugin installed should assess their exposure and prioritize updates or compensating controls.

Why it matters

CVE-2026-108168 is a medium-severity vulnerability in the WordPress Custom Query Blocks plugin, allowing for Stored XSS. Defenders should prioritize verifying and updating Custom Query Blocks, assessing exposure, and implementing compensating controls.

• Defenders need to verify Custom Query Blocks versions to prevent potential XSS exploitation
• Security teams should assess exposure in their WordPress environments
• Updating to a version beyond 5.6.0 is crucial for preventing exploitation
• Implementing compensating controls is necessary to detect and prevent exploitation

Technical summary

The Custom Query Blocks plugin for WordPress, versions up to 5.6.0, is vulnerable to Stored Cross Site Scripting (XSS). This is due to improper neutralization of input during web page generation. The vulnerability's CVSS score is 6.5, indicating medium severity.

Defensive priority

Defenders should prioritize verifying and updating Custom Query Blocks to a version beyond 5.6.0, assessing exposure in their WordPress environments, and implementing compensating controls to detect and prevent exploitation.

Recommended defensive actions

• Verify and update Custom Query Blocks to a version beyond 5.6.0
• Assess exposure in WordPress environments
• Implement compensating controls to detect and prevent exploitation

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and references to additional information. However, the corpus does not establish specific exploitation instances, impact, or remediation beyond version updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.