The Nexter Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts. These scripts will execute whenever a user accesses an affected page.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-8567 |
Exploitation
To exploit this vulnerability, an attacker with contributor-level access can inject malicious scripts into the user-supplied attributes of the Nexter Blocks plugin. When a user accesses a page containing these attributes, the injected scripts will execute in their browser, potentially leading to data theft or session hijacking.
Affected Products
- Nexter Blocks plugin for WordPress (all versions up to and including 4.5.4)
Mitigation
To mitigate this vulnerability, it is recommended to update the Nexter Blocks plugin to the latest version where the issue has been addressed. Additionally, implementing proper input sanitization and output escaping practices can help prevent similar vulnerabilities in the future.