Stored Cross-Site Scripting Vulnerability in IndieBlocks Plugin for WordPress

CVE-2025-5950

What is CVE-2025-5950?

The IndieBlocks plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the ‘kind’ parameter. This issue arises from inadequate input sanitization and output escaping in all versions up to and including 0.13.2. Authenticated attackers with Contributor-level access and higher can exploit this weakness to inject malicious scripts into pages. These scripts will execute whenever a user visits the compromised page, posing a significant risk to user data and site integrity.

References