CVE-2025-15678

MediumCVSS 6.1/10Last modified Sep 29, 2026

Description

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 6, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-156797.3Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequanCVE-2025-15688.8Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered GCVE-2025-156802.4TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate aCVE-2025-156819.2TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, CVE-2025-156828.7TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attCVE-2025-156838.8TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remoCVE-2025-156845.3A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diam_log_func of the file lib/diameter/common/init.c of the coCVE-2025-156856.3A flaw has been found in Open5GS up to 2.7.1. Affected by this vulnerability is an unknown functionality of the component freeDiameter. ThisCVE-2025-156864.3A vulnerability has been found in Open5GS up to 2.7.6. Affected by this issue is the function fd_msg_sess_get of the component HSS Service. CVE-2025-156874.3A security flaw has been discovered in Open5GS up to 2.7.6. Impacted is the function smf_gx_cca_cb of the component SMF Diameter Gx Credit-CCVE-2025-156889.3Unauthenticated SQL Injection in Capella <= 2.5.5 versions.CVE-2025-156899.8Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.