Stored Cross-Site Scripting Vulnerability in BlockSpare Plugin for WordPress
CVE-2025-4684
Key Information:
What is CVE-2025-4684?
The BlockSpare plugin for WordPress is affected by a vulnerability that allows for Stored Cross-Site Scripting through the HTML attributes of the Image Carousel and Image Slider widgets. This vulnerability arises from inadequate input sanitization and output escaping, enabling authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will be executed whenever any user accesses the compromised pages, potentially leading to data theft or unauthorized actions within the application.
Affected Version(s)
BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed * <= 3.2.13.1