Stored Cross-Site Scripting Vulnerability in PublishPress Blocks for WordPress
CVE-2025-8588
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 October 2025
What is CVE-2025-8588?
The PublishPress Blocks plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'Marker Title' and 'Marker Description' parameters of the Maps block. This vulnerability allows authenticated contributors and users with higher access levels to inject malicious scripts into web pages. When a user visits an affected page, these scripts can execute, potentially compromising user data and site integrity.
Affected Version(s)
Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks * <= 3.3.4