{"id":"CVE-2025-15702","kind":"vulnerability","aliases":["CVE-2025-15702"],"related":[],"title":"Cloud Blocks WordPress plugin: unauthenticated stored script injection in block editor","description":"The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.","summary":"The Cloud Blocks WordPress plugin through version 1.1.8 stores block asset URLs without checking who sends them or cleaning the input. An unauthenticated attacker can store malicious scripts that run in the browser of any logged-in administrator who opens the block editor.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-blocks","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Cloud Blocks plugin is installed and its version in the WordPress admin under Plugins (look for version `1.1.8` or earlier)","fix":null,"status":"open","published_at":"2026-11-05T06:17:06+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","triaged_at":"2026-11-05T06:33:22+00:00","updated_at":"2026-11-05T06:33:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:33:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Cloud Blocks WordPress plugin: unauthenticated stored script injection in block editor","impact":"high","summary":"The Cloud Blocks WordPress plugin through version 1.1.8 stores block asset URLs without checking who sends them or cleaning the input. An unauthenticated attacker can store malicious scripts that run in the browser of any logged-in administrator who opens the block editor.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","cloud-blocks","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs scripts in an administrator's browser, taking over the site","analyst_note":"Confirm the fixed version and whether a patch exists by checking the plugin's WordPress.org changelog or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-15702.","how_to_check":"- Check whether the Cloud Blocks plugin is installed and its version in the WordPress admin under Plugins (look for version `1.1.8` or earlier)\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Cloud Blocks WordPress plugin version 1.1.8 or earlier are exposed. The attack needs an administrator to open the block editor, so sites that do not use this plugin can skip it. The sources do not say which version fixes the issue.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":4220,"output_tokens":568,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15702':14A,17A '-2025':13A,16A '1.1.8':33B,76C 'administr':64B,109C 'allow':89C 'asset':36B,87C 'attack':49B 'authoris':81C 'block':2A,10A,20B,28B,35B,68B,72C,86C,113C 'browser':58B,101C 'check':39B 'clean':44B 'cloud':1A,19B,27B,71C 'cloud-block':18B 'cve':12A,15A 'editor':11A,69B,114C 'execut':98C 'host':24B 'inject':8A 'input':46B 'log':62B 'logged-in':61B 'malici':52B,94C 'open':66B,111C 'packag':21B 'perform':79C 'plugin':4A,30B,74C 'privileg':104C 'run':55B 'sanitis':83C 'script':7A,53B,95C 'self':23B 'self-host':22B 'send':41B 'store':6A,34B,51B,85C,93C 'unauthent':5A,48B,90C 'url':37B,88C 'user':91C,105C 'version':32B 'without':38B 'wordpress':3A,25B,29B,73C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Cloud Blocks WordPress plugin version 1.1.8 or earlier are exposed. The attack needs an administrator to open the block editor, so sites that do not use this plugin can skip it. The sources do not say which version fixes the issue.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudblocks","medium","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-15702","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15702","severity":null,"published_at":"2026-11-05T06:17:06+00:00","modified_at":"2026-11-05T06:17:06+00:00","first_seen_at":"2026-11-05T06:31:51+00:00","fetched_at":"2026-11-05T06:31:51+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}