Stored Cross-Site Scripting in Radius Blocks Plugin for WordPress

CVE-2025-5844

What is CVE-2025-5844?

The Radius Blocks plugin for WordPress suffers from a vulnerability that allows authenticated users with Contributor-level access and higher to perform Stored Cross-Site Scripting attacks through the 'subHeadingTagName' parameter. This security flaw arises from inadequate input sanitization and output escaping, enabling attackers to embed malicious scripts on pages, which execute whenever a user accesses those pages. The issue affects all versions of the plugin up to and including 2.2.1, posing a significant risk to site security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References