Stored Cross-Site Scripting Vulnerability in Ultimate Blocks Plugin for WordPress
CVE-2025-1703
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 March 2025
What is CVE-2025-1703?
The Ultimate Blocks plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability via the 'content' parameter. This issue arises from inadequate input sanitization and output escaping, allowing authenticated users with Contributor-level access or higher to embed malicious scripts into pages. These scripts will execute upon user access to the compromised page, escalating the risk of attacks against unsuspecting users and potentially compromising their data.
Affected Version(s)
Ultimate Blocks – WordPress Blocks Plugin * <= 3.2.7