Stored Cross-Site Scripting Vulnerability in BlockSpare Plugin for WordPress
CVE-2025-4684

6.4MEDIUM

What is CVE-2025-4684?

The BlockSpare plugin for WordPress is affected by a vulnerability that allows for Stored Cross-Site Scripting through the HTML attributes of the Image Carousel and Image Slider widgets. This vulnerability arises from inadequate input sanitization and output escaping, enabling authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will be executed whenever any user accesses the compromised pages, potentially leading to data theft or unauthorized actions within the application.

Affected Version(s)

BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed * <= 3.2.13.1

References

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Craig Smith
.
CVE-2025-4684 : Stored Cross-Site Scripting Vulnerability in BlockSpare Plugin for WordPress