CVE-2025-0506

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0506", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-15T20:03:39.209Z", "datePublished": "2025-02-12T09:22:48.315Z", "dateUpdated": "2026-06-03T14:28:00.663Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:30.249Z"}, "affected": [{"vendor": "eaglethemes", "product": "Rise Blocks \u2013 A Complete Gutenberg Page Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Rise Blocks \u2013 A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the titleTag parameter in all versions up to, and including, 3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Rise Blocks \u2013 A Complete Gutenberg Page Builder <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleTag Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec012e7-b997-466e-8676-8e9467473eae?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/rise-blocks/tags/3.6/classes/blocks/site-identity.php#L375"}, {"url": "https://plugins.trac.wordpress.org/browser/rise-blocks/tags/3.7/classes/blocks/site-identity.php#L375"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nirmal"}], "timeline": [{"time": "2024-12-14T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-02-11T21:07:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-12T14:38:41.437784Z", "id": "CVE-2025-0506", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T14:28:00.663Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0506", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-12T14:38:41.437784Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-12T14:39:58.966Z"}}], "cna": {"title": "Rise Blocks \u2013 A Complete Gutenberg Page Builder <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleTag Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Nirmal"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "eaglethemes", "product": "Rise Blocks \u2013 A Complete Gutenberg Page Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-12-14T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-02-11T21:07:48.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec012e7-b997-466e-8676-8e9467473eae?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/rise-blocks/tags/3.6/classes/blocks/site-identity.php#L375"}, {"url": "https://plugins.trac.wordpress.org/browser/rise-blocks/tags/3.7/classes/blocks/site-identity.php#L375"}], "descriptions": [{"lang": "en", "value": "The Rise Blocks \u2013 A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the titleTag parameter in all versions up to, and including, 3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:30.249Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0506", "state": "PUBLISHED", "dateUpdated": "2026-06-03T14:28:00.663Z", "dateReserved": "2025-01-15T20:03:39.209Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-12T09:22:48.315Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Rise Blocks \u2013 A Complete Gutenberg Page Builder", "vendor": "eaglethemes", "versions": [{"lessThanOrEqual": "3.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eaglevisionit:rise_blocks:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "DF3BCFA9-D153-43D4-A95C-71758F0EA95E", "versionEndIncluding": "3.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Rise Blocks \u2013 A Complete Gutenberg Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the titleTag parameter in all versions up to, and including, 3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Rise Blocks \u2013 A Complete Gutenberg Page Builder para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro titleTag en todas las versiones hasta la 3.6 incluida, debido a un escape de entrada desinfecci\u00f3n y de salida insuficiente. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitraria en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-0506", "lastModified": "2026-06-17T08:26:37.007", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0506", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-02-12T14:38:41.437784Z", "version": "2.0.3"}}]}, "published": "2025-02-12T10:15:14.360", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/rise-blocks/tags/3.6/classes/blocks/site-identity.php#L375"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/rise-blocks/tags/3.7/classes/blocks/site-identity.php#L375"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2ec012e7-b997-466e-8676-8e9467473eae?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T03:41:16.991309+00:00", "value": {"mitigation_remediation": ["Upgrade the Rise Blocks plugin to the latest published version (3.7 or newer) to remove the vulnerable titleTag handling code.", "If an immediate upgrade is not possible, restrict or remove the titleTag parameter by disabling the site\u2011identity block for non\u2011administrator roles, or revoke Contributor role from users who do not require editing capability.", "As a temporary workaround, replace the default input processing with proper sanitization, e.g. apply `sanitize_text_field` or `wp_kses_post` to the titleTag value before saving it to the database."], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting (Authenticated)"}, "threat_synthesis": {"affected_systems": "Any WordPress installation that uses the Rise Blocks \u2013 A Complete Gutenberg Page Builder plugin of version 3.6 or earlier is affected. The vulnerability applies to all releases through 3.6 as identified by the vendor and confirmed by source code references. No specific sub\u2011release information is available beyond that the flaw exists up to and including 3.6.", "description_and_impact": "The Rise Blocks \u2013 A Complete Gutenberg Page Builder plugin for WordPress contains a stored cross\u2011site scripting flaw in the titleTag parameter. The plugin fails to properly sanitize or escape the value supplied by users with Contributor or higher privileges, enabling them to inject arbitrary JavaScript that executes whenever a page containing the injected block is loaded. Once injected, the script runs in the browser context of every visitor to that page, potentially leading to session hijacking, credential theft, phishing, or site defacement.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw requires an authenticated user with at least Contributor role, meaning the attacker must first compromise valid credentials or abuse an existing account with sufficient privileges. Because the vulnerability is stored, a single injection can affect all site visitors until the content is cleaned or the plugin is updated. The flaw is not listed in the CISA KEV catalog, so it has not been observed in large\u2011scale exploitation campaigns as of now."}}}}, "created": "2026-04-28T03:45:20.282213+00:00", "updated": "2026-04-28T03:45:20.282231+00:00", "vendors": []}