---
id: "CVE-2025-15702"
kind: "vulnerability"
aliases: ["CVE-2025-15702"]
title: "Cloud Blocks WordPress plugin: unauthenticated stored script injection in block editor"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cloud-blocks", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-05T06:17:06+00:00"
first_seen_at: "2026-11-05T06:31:51+00:00"
updated_at: "2026-11-05T06:33:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15702", "first_seen_at": "2026-11-05T06:31:51+00:00"}]
exploit_sources: []
---

# Cloud Blocks WordPress plugin: unauthenticated stored script injection in block editor

The Cloud Blocks WordPress plugin through version 1.1.8 stores block asset URLs without checking who sends them or cleaning the input. An unauthenticated attacker can store malicious scripts that run in the browser of any logged-in administrator who opens the block editor.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Cloud Blocks plugin is installed and its version in the WordPress admin under Plugins (look for version `1.1.8` or earlier)

## Timeline

- 2026-11-05T06:31:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-15702

## From the sources

The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_