CVE-2026-108168 in Custom Query Blocks Plugin
Summary
by MITRE • 10/12/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The identified security flaw represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this vulnerability manifests within the DLX Plugins Custom Query Blocks environment when handling post-type-archive-mapping configurations. The core technical deficiency lies in the application's failure to adequately sanitize or encode user-supplied input before it is rendered into HTML output by the web server. This lack of proper validation allows an attacker to inject malicious scripts, typically JavaScript, which are then stored on the target system and executed whenever a victim accesses the affected page. Because this is classified as Stored XSS rather than reflected XSS, the payload persists in the database or configuration files, meaning every user who views the compromised content will have their session hijacked or interact with the injected script without any additional action required by the attacker to trigger execution beyond normal browsing behavior.
The operational impact of this vulnerability is severe due to its persistent nature and potential for widespread exploitation within WordPress environments that utilize these plugins. An authenticated attacker, typically requiring at least contributor-level access depending on specific plugin configurations, can embed malicious code into the post-type-archive-mapping settings. Once stored, this script executes in the context of any user viewing the archive page associated with that mapping. This enables a range of hostile actions including session hijacking through cookie theft, credential harvesting via keyloggers or fake login forms injected into the DOM, redirection to phishing sites designed to steal credentials from unsuspecting visitors, and potentially defacing the website's appearance. The persistence of the attack vector means that remediation requires not only patching the software but also manually clearing any malicious scripts already stored in the database by previous attackers.
From a standards perspective, this vulnerability aligns directly with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The specific mechanism involves insufficient output encoding or validation when rendering dynamic content derived from user-controlled inputs within the plugin's mapping logic. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques found under Taint Analysis and subsequent Execution phases where injected scripts are used for Collection via Browser Session Hijacking (T1539) or Input Capture via Keylogging (T1056). The vulnerability exploits the trust relationship between the browser and the website content, bypassing same-origin policies because the malicious script originates from a trusted domain.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary and most effective solution is to upgrade the DLX Plugins Custom Query Blocks software immediately to version 5.6.1 or later where this issue has been resolved through proper input sanitization and output encoding practices. For organizations unable to patch instantly, temporary workarounds may include restricting administrative access strictly to trusted personnel with strong multi-factor authentication enabled to prevent unauthorized configuration changes that could introduce stored payloads. Additionally, implementing a Web Application Firewall (WAF) can provide an additional layer of defense by detecting and blocking common XSS patterns in HTTP requests before they reach the application logic. Regular security audits focusing on input validation across all plugin endpoints are recommended to ensure no similar vulnerabilities exist elsewhere in the codebase that could be exploited using analogous techniques.