Stored Cross-Site Scripting Vulnerability in Osom Blocks Plugin for WordPress
CVE-2025-5940
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 June 2025
What is CVE-2025-5940?
The Osom Blocks plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the 'class_name' parameter. This issue affects all versions up to and including 1.2.1, allowing attackers with Contributor-level permissions and above to inject arbitrary web scripts. These scripts can execute when users access the compromised pages, potentially compromising user data and site integrity.
Affected Version(s)
Osom Blocks – Custom Post Type listing block * <= 1.2.1