Stored Cross-Site Scripting Vulnerability in Gotham Block Extra Light Plugin for WordPress

CVE-2025-15021

What is CVE-2025-15021?

The Gotham Block Extra Light plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in administrator settings. This vulnerability can allow attackers with administrator-level access to inject malicious web scripts, which will execute in the browser of any user who visits the compromised page. It is particularly concerning for installations that have disabled unfiltered_html and in multi-site environments, where the impact can be broader.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References