The Nexter Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts. These scripts will execute whenever a user accesses an injected page, posing a significant security risk.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-8567 |
Exploitation
To exploit this vulnerability, an attacker with contributor-level access can inject malicious scripts into the user-supplied attributes of the Nexter Blocks plugin. Once the scripts are injected, they will execute when other users access the affected pages, allowing the attacker to perform actions such as stealing session cookies or redirecting users to malicious sites.
Affected Products
- Nexter Blocks plugin for WordPress (all versions up to and including 4.5.4): Vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization.
Mitigation
To mitigate this vulnerability, it is recommended to update the Nexter Blocks plugin to the latest version where the issue has been addressed. Additionally, implementing proper input sanitization and output escaping practices can help prevent similar vulnerabilities in the future.