CVE-2026-4658 — Cross-Site Scripting (XSS)

title: WordPress Essential Blocks Stored XSS via className Attribute - CVE-2026-4658
id: scw-2026-05-02-ai-1
status: experimental
level: medium
description: |
  Detects attempts to exploit CVE-2026-4658 in the Essential Blocks plugin for WordPress. This rule specifically looks for requests targeting the plugin's directory and containing suspicious parameters (className, classHook, blockId) along with common XSS payloads like '<script>' or 'alert('. This indicates a potential Stored XSS attack where an attacker injects malicious scripts into the className, classHook, or blockId attributes of the Add to Cart block.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-4658/
tags:
  - attack.execution
  - attack.t1059.001
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-content/plugins/essential-blocks/'
      cs-uri-query|contains:
          - 'className=' 
          - 'classHook='
          - 'blockId='
      cs-uri-query|contains:
          - '<script>'
          - 'alert('
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse