Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-85679 · Microsoft / collected KEV context

cve-program · CVE-2026-85679

• https://www.wordfence.com/threat-intel/vulnerabilities/id/38024680-2d99-4af0-b805-6fd718a1d338?source=cve
• https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L62
• https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L75
• https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L29
• https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/app/Shared/Services/BlockStyleVariations.php#L37
• https://plugins.trac.wordpress.org/browser/extendify/tags/3.1.6/bootstrap.php#L112
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3688833%40extendify%2Ftags%2F3.2.0&old=3669317%40extendify%2Ftags%2F3.1.6
• https://plugins.trac.wordpress.org/changeset/3688833/extendify/trunk/app/Shared/Services/BlockStyleVariations.php

No related operational record is retained in the current change model.