CVE-2025-13697

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13697", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-25T21:15:15.664Z", "datePublished": "2025-12-02T01:51:56.790Z", "dateUpdated": "2026-04-08T17:17:56.011Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:56.011Z"}, "affected": [{"vendor": "wpblockart", "product": "BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.13", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018timestamp\u2019 attribute in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via `timestamp` Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b91364fa-7046-427f-84ee-6a36d49bb80f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3404884/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Farhan Dio Arrafiq"}], "timeline": [{"time": "2025-11-16T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-01T11:37:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-02T16:50:38.863809Z", "id": "CVE-2025-13697", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-02T16:55:24.948Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13697", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-02T16:50:38.863809Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-02T16:50:37.827Z"}}], "cna": {"title": "BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via `timestamp` Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Farhan Dio Arrafiq"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpblockart", "product": "BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.13"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-16T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-12-01T11:37:01.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b91364fa-7046-427f-84ee-6a36d49bb80f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3404884/"}], "descriptions": [{"lang": "en", "value": "The BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018timestamp\u2019 attribute in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:56.011Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13697", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:17:56.011Z", "dateReserved": "2025-11-25T21:15:15.664Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-02T01:51:56.790Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library", "vendor": "wpblockart", "versions": [{"lessThanOrEqual": "2.2.13", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018timestamp\u2019 attribute in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin BlockArt Blocks - Gutenberg Blocks, Page Builder Blocks, WordPress Block Plugin, Sections & Biblioteca de Plantillas para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del atributo 'timestamp' en todas las versiones hasta la 2.2.13, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13697", "lastModified": "2026-10-18T18:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13697", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-02T16:50:38.863809Z", "version": "2.0.3"}}]}, "published": "2025-12-02T03:16:15.873", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3404884/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b91364fa-7046-427f-84ee-6a36d49bb80f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:13:10.646631+00:00", "value": {"mitigation_remediation": ["Update the BlockArt Blocks plugin to the latest available version (2.2.14 or newer) that removes unsanitised handling of the timestamp attribute.", "If an upgrade is temporarily infeasible, eliminate the use of the timestamp attribute by either removing the block from pages or editing the plugin\u2019s source to hard\u2011code a safe value and restrict edit capabilities to trusted users only.", "Deploy a Web Application Firewall rule that detects suspicious script payloads inserted into the timestamp field and blocks or sanitises such content before it reaches the database."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All users of the BlockArt Blocks \u2013 Gutenberg Blocks, Page Builder Blocks, WordPress Block Plugin, Sections & Template Library plugin for WordPress with versions 2.2.13 or earlier are affected. No more recent versions are listed as vulnerable; the issue exists in every release up to and including 2.2.13.", "description_and_impact": "The BlockArt Blocks plugin is vulnerable to stored XSS because the \u2018timestamp\u2019 attribute is not properly sanitized or escaped. When a contributor or higher level user submits a payload via this field, it is written to the database and later rendered unchanged on any page that includes the block. An attacker can thus inject arbitrary JavaScript that executes in the browsers of all visitors who view the affected page, potentially allowing session hijacking, credential theft, defacement, or further malicious activity.", "risk_and_exploitability": "With a CVSS score of 6.4 the vulnerability is considered moderate. The EPSS score is below 1\u202f%, indicating a very low likelihood of exploitation. It is not included in the CISA KEV catalog. Exploitation requires a valid contributor\u2011level or higher account to inject the payload, and the injected code will run whenever any user loads the affected page. Based on the data, these conditions make the vulnerability modestly serious but unlikely to be actively exploited in the near term."}}}}, "created": "2025-12-02T11:58:31.821762+00:00", "updated": "2026-04-21T01:15:20.136734+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpblockart", "wpblockart$PRODUCT$blockart_blocks"]}