Stored Cross-Site Scripting in Radius Blocks Plugin for WordPress

CVE-2025-5844

What is CVE-2025-5844?

The Radius Blocks plugin for WordPress suffers from a vulnerability that allows authenticated users with Contributor-level access and higher to perform Stored Cross-Site Scripting attacks through the 'subHeadingTagName' parameter. This security flaw arises from inadequate input sanitization and output escaping, enabling attackers to embed malicious scripts on pages, which execute whenever a user accesses those pages. The issue affects all versions of the plugin up to and including 2.2.1, posing a significant risk to site security.

References