CVE-2025-15702

HighCVSS 8.8/10Last modified Nov 9, 2026

Description

The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	Cloud Blocks	<= 1.1.8

References

https://wpscan.com/vulnerability/586f975b-1448-4ff5-b030-aa7bcdd45318/

Timeline

Published: Nov 5, 2026
Last modified: Nov 9, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-157033.5The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back i CVE-2025-157053.5The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the for CVE-2025-157083.5The Live Composer WordPress plugin before 2.1.23 does not sanitise and escape some of its custom post type slug settings before using them CVE-2025-15715.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Imag CVE-2025-157113.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href CVE-2025-157123.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in p CVE-2025-157133.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting th CVE-2025-157143.5The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on CVE-2025-15728.8The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all CVE-2025-15754.3A vulnerability classified as problematic has been found in Harpia DiagSystem 12. Affected is an unknown function of the file /diagsystem/PA CVE-2025-15769.8A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability CVE-2025-15775.4A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank System 1.0. Affected by this issue is some