CVE-2025-1625

The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:qodeinteractive:qi_blocks:*:*:*:*:*:wordpress:*:*

History

17 Jun 2025, 20:47

Type Values Removed Values Added
CWE CWE-79
CPE cpe:2.3:a:qodeinteractive:qi_blocks:*:*:*:*:*:wordpress:*:*
References () https://wpscan.com/vulnerability/288208c4-e9ca-4b79-88e7-fb415a726fce/ - () https://wpscan.com/vulnerability/288208c4-e9ca-4b79-88e7-fb415a726fce/ - Exploit, Third Party Advisory
First Time Qodeinteractive
Qodeinteractive qi Blocks

19 May 2025, 15:15

Type Values Removed Values Added
Summary
  • (es) El complemento Qi Blocks para WordPress anterior a la versión 1.4 no valida ni escapa algunas de las opciones de su bloque Counter antes de mostrarlas en una página o publicación donde está incrustado el bloque, lo que podría permitir a los usuarios con rol de colaborador o superior realizar ataques de Cross-Site Scripting almacenado.
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.4

19 May 2025, 06:15

Type Values Removed Values Added
New CVE

Information

Published : 2025-05-19 06:15

Updated : 2025-06-17 20:47


NVD link : CVE-2025-1625

Mitre link : CVE-2025-1625

CVE.ORG link : CVE-2025-1625


JSON object : View

Products Affected

qodeinteractive

  • qi_blocks
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')