Stored Cross-Site Scripting Vulnerability in Nexter Blocks Plugin for WordPress
CVE-2025-8567
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 19 August 2025
What is CVE-2025-8567?
The Nexter Blocks plugin for WordPress is susceptible to Stored Cross-Site Scripting through various widgets in all versions up to and including 4.5.4. This vulnerability arises from inadequate input sanitization and output escaping on attributes provided by users. As a result, authenticated attackers with contributor-level access or higher can execute malicious web scripts on pages, which will run whenever a user accesses the compromised page. Immediate action is advised to mitigate potential risks associated with this vulnerability.
Affected Version(s)
Nexter Blocks – WordPress Gutenberg Blocks & 1000+ Starter Templates * <= 4.5.4