CVE-2025-15702highCWE-79

CVE-2025-15702: high-severity vulnerability in Cloud Blocks

Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSS

Published · Updated

Follow this CVE+ Monitor Cloud Blocks

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.8epss 0.3%
The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · Cloud Blocks
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.