Missing Authorization in Qi Blocks Plugin for WordPress

CVE-2025-12180

What is CVE-2025-12180?

The Qi Blocks plugin for WordPress is susceptible to a missing authorization vulnerability across all versions up to 1.4.3. This flaw arises from the inadequate sanitization of arbitrary CSS styles submitted at the qi-blocks/v1/update-styles REST API endpoint via the update_global_styles_callback() function. As a result, authenticated users with Contributor-level access and higher can exploit this vulnerability to inject malicious CSS, potentially enabling actions such as content concealment, overlaying deceptive UI elements, or extracting confidential data through CSS injection techniques.

References