Canvas
Canvas has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Canvas has a vendor fix available, so running the current release closes it.
All of these findings were reported by Muhammad Yudha - DJ. Canvas is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2026-9629Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute
Read the full analysisVulnerability Records

Canvas
Author
codesupplyco
Canvas is a powerful, feature-rich block-based page builder that revolutionizes how you create content in WordPress. Built to seamlessly integrate with the WordPress block editor, Canvas enhances your creative workflow with an exceptional combination of advanced functionality and intuitive design. Key Features: Diverse Block Collection – From basic elements to complex layouts, Canvas provides all the building blocks you need: Alert, Progress, Tabs, Collapsibles, Section Headings, and many more. Flexible Layout System – Create responsive grid-based layouts with Row and Column blocks, complete with adjustable widths, gaps, and responsive controls. Rich Media Galleries – Present your visual content beautifully with Justified Gallery and Slider Gallery blocks with extensive customization options. Advanced Posts Display – Showcase your content in various layouts with powerful query controls including filtering by categories, tags, and post types. Responsive Design Controls – Ensure your content looks great on all devices with device-specific visibility and styling options. Styling Flexibility – Add sophisticated styling with controls for spacing, borders, colors, and more. Custom Block Extensions – Extend core WordPress blocks with additional functionality and styling options. Canvas empowers both developers and content creators to build sophisticated, responsive layouts without writing code. Whether you’re creating blog posts, landing pages, or complex website layouts, Canvas provides the tools you need for professional results with minimal effort. Designed with performance in mind, Canvas generates clean, optimized code that won’t slow down your website, ensuring a smooth user experience for your visitors. Experience the perfect balance of power and simplicity with Canvas – where exceptional design meets unlimited creative freedom.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C