CVE-2026-6378 | ckp267 MaxiBlocks Builder Plugin up to 2.1.9 on WordPress REST API Endpoint style-card sc_styles cross site scripting (EUVD-2026-26728)

A vulnerability marked as problematic has been reported in ckp267 MaxiBlocks Builder Plugin up to 2.1.9 on WordPress. This affects an unknown part of the file /wp-json/maxi-blocks/v1.0/style-card of the component REST API Endpoint. The manipulation of the argument sc_styles leads to cross site scripting.

This vulnerability is documented as CVE-2026-6378. The attack can be initiated remotely. There is not any exploit available.

It is suggested to upgrade the affected component.