Cross-site Scripting Vulnerability in ZoloBlocks Plugin by bdthemes
CVE-2025-58230

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Zoloblocks
Vendor
CVE Published:
22 September 2025

What is CVE-2025-58230?

The ZoloBlocks plugin by bdthemes contains a vulnerability that allows for improper neutralization of user input during web page generation, leading to a DOM-based cross-site scripting (XSS) risk. This vulnerability affects ZoloBlocks versions ranging from n/a up to 2.3.9, which may allow malicious actors to inject arbitrary scripts that could compromise the integrity of user data or lead to other attacks. It is essential for users of affected versions to implement security measures to mitigate these risks.

Affected Version(s)

ZoloBlocks <= 2.3.9

References

https://patchstack.com/database/wordpress/plugin/zolobloc...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abu Hurayra (Patchstack Alliance)
JSON
.