CVE-2025-11270

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11270", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-03T20:27:24.555Z", "datePublished": "2025-10-18T06:42:47.961Z", "dateUpdated": "2026-04-08T17:14:28.369Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:28.369Z"}, "affected": [{"vendor": "wpdevteam", "product": "Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.7.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aace327b-7091-48e2-9e02-ec48a08b129b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3376903/essential-blocks/trunk/views/woocommerce/title.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-10-03T20:42:38.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-17T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-20T18:33:56.341879Z", "id": "CVE-2025-11270", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T18:34:10.503Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11270", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-20T18:33:56.341879Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T18:34:05.317Z"}}], "cna": {"title": "Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpdevteam", "product": "Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.7.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-03T20:42:38.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-17T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aace327b-7091-48e2-9e02-ec48a08b129b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3376903/essential-blocks/trunk/views/woocommerce/title.php"}], "descriptions": [{"lang": "en", "value": "The Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-18T06:42:47.961Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11270", "state": "PUBLISHED", "dateUpdated": "2025-10-20T18:34:10.503Z", "dateReserved": "2025-10-03T20:27:24.555Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-18T06:42:47.961Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns", "vendor": "wpdevteam", "versions": [{"lessThanOrEqual": "5.7.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del atributo 'titleTag' en todas las versiones hasta la 5.7.1, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-11270", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11270", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-20T18:33:56.341879Z", "version": "2.0.3"}}]}, "published": "2025-10-18T07:15:34.687", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3376903/essential-blocks/trunk/views/woocommerce/title.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aace327b-7091-48e2-9e02-ec48a08b129b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:13:56.210847+00:00", "value": {"mitigation_remediation": ["Upgrade Gutenberg Essential Blocks to the latest version, which contains a fix for the stored XSS in the 'titleTag' attribute.", "Restrict contributors from editing block titles that expose the 'titleTag' field, or remove contributor permissions for activating the plugin's block editing features.", "Deploy a web application firewall or content security policy that blocks execution of unexpected JavaScript injected via block titles."], "summary": {"action": "Apply Patch", "impact": "Stored Cross-Site Scripting (CWE-79)."}, "threat_synthesis": {"affected_systems": "Vendors affected are wpdevteam's Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns plugin. All releases up to and including 5.7.1 are vulnerable; any WordPress site using these plugin versions is at risk.", "description_and_impact": "The Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns plugin contains a stored cross\u2011site scripting flaw due to inadequate sanitization of the 'titleTag' attribute. Authenticated users with Contributor level or higher can inject arbitrary JavaScript that will execute in the browsers of any visitor who loads the tampered page, potentially compromising confidentiality, integrity, or facilitating phishing or defacement attacks.", "risk_and_exploitability": "The CVSS base score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, and it requires authenticated Contributor-level access to craft the payload, limiting attacker eligibility. Nevertheless, if an attacker gains such access, the stored payload can persist and affect all users who visit the compromised page."}}}}, "created": "2025-10-20T13:21:34.068189+00:00", "updated": "2026-04-21T02:15:06.532524+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpdevteam", "wpdevteam$PRODUCT$gutenberg_essential_blocks"]}