Stored Cross-Site Scripting Vulnerability in Blocksy Companion Plugin for WordPress

CVE-2025-12475

What is CVE-2025-12475?

The Blocksy Companion plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on attributes supplied by users. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the 'blocksy_newsletter_subscribe' shortcode. These scripts will execute whenever an unsuspecting user visits the compromised page, potentially leading to unauthorized actions and data exposure.

References