{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1312", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-14T20:50:47.872Z", "datePublished": "2025-03-26T11:22:10.695Z", "dateUpdated": "2026-04-08T17:14:50.514Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:50.514Z"}, "affected": [{"vendor": "ultimateblocks", "product": "Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultimate Blocks \u2013 WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor\u2019 parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Ultimate Blocks \u2013 WordPress Blocks Plugin <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac422162-be05-4420-9877-d6d41b83e881?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/call-to-action/block.php#L32"}, {"url": "https://plugins.trac.wordpress.org/changeset/3260377/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2025-03-25T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-26T13:25:04.341119Z", "id": "CVE-2025-1312", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T13:25:23.763Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1312", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-26T13:25:04.341119Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-26T13:25:15.283Z"}}], "cna": {"title": "Ultimate Blocks \u2013 WordPress Blocks Plugin <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ultimateblocks", "product": "Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-25T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac422162-be05-4420-9877-d6d41b83e881?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/call-to-action/block.php#L32"}, {"url": "https://plugins.trac.wordpress.org/changeset/3260377/"}], "descriptions": [{"lang": "en", "value": "The Ultimate Blocks \u2013 WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor\u2019 parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:50.514Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1312", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:50.514Z", "dateReserved": "2025-02-14T20:50:47.872Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-26T11:22:10.695Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Blocks \u2013 WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor\u2019 parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Ultimate Blocks \u2013 WordPress Blocks para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro 'buttonTextColor' en todas las versiones hasta la 3.2.7 incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-1312", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-03-26T12:15:14.890", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/trunk/src/blocks/call-to-action/block.php#L32"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3260377/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac422162-be05-4420-9877-d6d41b83e881?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:28:24.127151+00:00", "value": {"mitigation_remediation": ["Upgrade Ultimate Blocks to the latest version, which removes the unsanitized input handling.", "If an upgrade is not possible, delete or sanitize existing blocks that contain malicious data and remove the 'buttonTextColor' field from any custom block definitions.", "Restrict contributor or higher roles to only trusted users and audit role assignments regularly.", "If the plugin is no longer needed, deactivate or uninstall it entirely."], "summary": {"action": "Patch or Upgrade", "impact": "Stored Cross\u2011Site Scripting via authenticated Contributor+ access"}, "threat_synthesis": {"affected_systems": "Affected sites are those running the Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor plugin, versions 3.2.7 and earlier. The vulnerability exists in all block types that expose the 'buttonTextColor' parameter. Sites that have not upgraded beyond 3.2.7 remain vulnerable.", "description_and_impact": "The Ultimate Blocks plugin contains a stored cross\u2011site scripting flaw that arises from the 'buttonTextColor' field not being properly sanitized or escaped. When a contributor or higher user supplies a malicious value, the script is stored in the block definition and will be executed each time the block is rendered. This allows the attacker to run arbitrary code in the browser context of any visitor to the affected page, potentially hijacking user sessions or exfiltrating data.", "risk_and_exploitability": "The flaw carries a CVSS score of 6.4, indicating a medium\u2011to\u2011high impact if exploited, but the EPSS score of less than 1% shows the likelihood of exploitation is very low. The issue is not listed in the CISA KEV catalog. Attackers need only contributor permissions or higher to inject the payload, so the attack vector is authenticated web interface. While the risk is moderate, the potential damage to confidentiality, integrity and availability of users' browsers warrants prompt action."}}}}, "created": "2026-04-20T23:30:16.125324+00:00", "updated": "2026-04-20T23:30:16.125341+00:00", "vendors": []}