Stored Cross-Site Scripting Vulnerability in Nexa Blocks Plugin for WordPress
CVE-2025-8624
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 30 September 2025
What is CVE-2025-8624?
The Nexa Blocks plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability via its Google Maps widget. This issue arises from insufficient input sanitization and output escaping for user-supplied attributes. As a result, authenticated attackers with contributor-level access and above can exploit this vulnerability to inject arbitrary web scripts into pages viewed by users, potentially compromising user sessions and application integrity.
Affected Version(s)
Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE * <= 1.1.0