CVE-2025-1703

Vulnerability

Description The Ultimate Blocks plugin for WordPress, available on the official plugin repository [1], is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 3.2.7. The vulnerability arises from insufficient input sanitization and output escaping of the 'content' parameter, allowing malicious HTML and JavaScript to be stored in the database.

Attack

Vector An authenticated attacker with at least Contributor-level access can exploit this flaw by injecting arbitrary web scripts through the 'content' parameter when creating or editing posts with Ultimate Blocks. The injected scripts are stored and will execute whenever any user, including administrators, views the affected page.

Impact

Successful exploitation leads to stored XSS, enabling attackers to perform actions such as stealing session cookies, redirecting users to malicious sites, or defacing pages. The attack does not require any special network access or user interaction beyond viewing the compromised content.

Mitigation

The plugin vendor has not yet released an official patch for versions beyond 3.2.7. Users are advised to update to the latest version available on the WordPress plugin repository [1] and to restrict Contributor-level access to trusted users only.