CVE-2025-11162

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11162", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-29T15:38:47.603Z", "datePublished": "2025-11-05T04:36:58.130Z", "dateUpdated": "2026-04-08T16:44:34.155Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:34.155Z"}, "affected": [{"vendor": "brainstormforce", "product": "Spectra Gutenberg Blocks \u2013 Website Builder for the Block Editor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.19.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Spectra Gutenberg Blocks \u2013 Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2.19.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f077817-704f-4595-bfb1-80234dd23f8d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.14/classes/class-uagb-loader.php#L522"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.14/classes/class-uagb-post-assets.php#L1418"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-09-26T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-09-29T15:54:41.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-04T16:25:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-05T14:18:28.291279Z", "id": "CVE-2025-11162", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T18:47:49.874Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11162", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T14:18:28.291279Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T14:18:31.397Z"}}], "cna": {"title": "Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "brainstormforce", "product": "Spectra Gutenberg Blocks \u2013 Website Builder for the Block Editor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.19.14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-26T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-09-29T15:54:41.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-04T16:25:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f077817-704f-4595-bfb1-80234dd23f8d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.14/classes/class-uagb-loader.php#L522"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.14/classes/class-uagb-post-assets.php#L1418"}], "descriptions": [{"lang": "en", "value": "The Spectra Gutenberg Blocks \u2013 Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2.19.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:34.155Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11162", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:44:34.155Z", "dateReserved": "2025-09-29T15:38:47.603Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-05T04:36:58.130Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Spectra Gutenberg Blocks \u2013 Website Builder for the Block Editor", "vendor": "brainstormforce", "versions": [{"lessThanOrEqual": "2.19.14", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Spectra Gutenberg Blocks \u2013 Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and including, 2.19.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Spectra Gutenberg Blocks - Website Builder for the Block Editor para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del CSS Personalizado en todas las versiones hasta la 2.19.14, inclusive, debido a la sanitizaci\u00f3n insuficiente de la entrada y al escape de la salida. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-11162", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11162", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-05T14:18:28.291279Z", "version": "2.0.3"}}]}, "published": "2025-11-05T05:15:41.400", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.14/classes/class-uagb-loader.php#L522"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/tags/2.19.14/classes/class-uagb-post-assets.php#L1418"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2f077817-704f-4595-bfb1-80234dd23f8d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:20:26.959221+00:00", "value": {"mitigation_remediation": ["Upgrade Spectra Gutenberg Blocks to the latest stable release (greater than 2.19.14) to eliminate the sanitization flaw.", "If an upgrade is not feasible immediately, remove or disable the Custom CSS capability for Contributor and lower roles using a role\u2011management plugin such as User Role Editor, ensuring contributors cannot add custom CSS that could be stored.", "Apply a strict Content Security Policy (CSP) that blocks inline scripts and restricts script sources, reducing the impact of any residual stored XSS content."], "summary": {"action": "Update plugin", "impact": "Stored cross\u2011site scripting enabling authenticated contributors to inject and execute scripts in the browsers of other site users"}, "threat_synthesis": {"affected_systems": "WordPress installations using the Spectra Gutenberg Blocks plugin version 2.19.14 or earlier are affected. The vulnerability exists across all versions up to and including 2.19.14, regardless of other plugins or themes installed. Users must verify the plugin version in their WordPress dashboard and ensure they are not running a vulnerable release.", "description_and_impact": "The Spectra Gutenberg Blocks \u2013 Website Builder for the Block Editor plugin is vulnerable due to insufficient sanitization of the Custom CSS field, allowing stored cross\u2011site scripting. An attacker with Contributor or higher access can save malicious code that will be rendered on any page containing the injected CSS, potentially running arbitrary JavaScript in the context of any visitor\u2019s browser. The ability to execute scripts in victims\u2019 browsers can lead to social engineering, credential theft, or defacement of the site. The vulnerability is a typical interface\u2011based injection flaw as identified by CWE\u201179.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a medium severity. The EPSS score is less than 1%, suggesting current exploitation is rare, and the vulnerability is not listed in CISA\u2019s KEV catalog. However, the attack requires authenticated access at Contributor level or higher, which many site administrators and editors possess. Once injected, the stored script can affect all users who view the affected page, providing a wide range of potential damage.\nThe likely attack vector is through the Custom CSS editor in the plugin\u2019s interface, where an attacker can insert malicious inline styles or script tags that are stored in the database and later rendered on page load. This condition demonstrates that an attacker can drive arbitrary code execution in victim browsers without requiring external files or other exploits."}}}}, "created": "2025-11-05T10:47:02.931738+00:00", "updated": "2026-04-22T21:30:27.816266+00:00", "vendors": ["brainstormforce", "brainstormforce$PRODUCT$spectra", "wordpress", "wordpress$PRODUCT$wordpress"], "weaknesses": ["CWE-79"]}