CVE-2025-15702 · Package
NO FIX YET
The Cloud Blocks WordPress plugin through version 1.1.8 stores block asset URLs without checking who sends them or cleaning the input. An unauthenticated attacker can store malicious scripts that run in the browser of any logged-in administrator who opens the block editor.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Cloud Blocks WordPress plugin version 1.1.8 or earlier are exposed. The attack needs an administrator to open the block editor, so sites that do not use this plugin can skip it. The sources do not say which version fixes the issue.
Not affected if plugin-not-installed
Who cares cloud-blocks, self-hosted, wordpress
1.1.8 or earlier)No fix yet, per the sources.
The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.