Stored Cross-Site Scripting in ZoloBlocks Plugin for WordPress
CVE-2025-9075
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 1 October 2025
What is CVE-2025-9075?
The ZoloBlocks plugin for WordPress introduces a vulnerability that allows for Stored Cross-Site Scripting (XSS) through several Gutenberg blocks. This issue is attributed to inadequate input sanitization and output escaping on user-defined attributes across multiple block components. Specifically affected are Google Maps markers, Lightbox captions, Image Gallery data attributes, Progress Pie prefix/suffix fields, and Text Path URL fields. Authenticated attackers, holding contributor-level access or higher, can exploit this flaw to inject arbitrary scripts into pages, compromising user data when those pages are accessed.
Affected Version(s)
ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns * <= 2.3.10