Stored Cross-Site Scripting Vulnerability in Useful Tab Block Plugin for WordPress

CVE-2025-5754

What is CVE-2025-5754?

The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress is susceptible to a Stored Cross-Site Scripting attack through the 'className' parameter due to inadequate input sanitization and output escaping. This vulnerability allows authenticated attackers with Contributor-level access or higher to insert arbitrary web scripts into pages. The malicious code executes when users access the compromised page, potentially leading to data theft or account hijacking.

References