CVE-2025-2918

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2918", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-28T11:40:22.930Z", "datePublished": "2025-06-10T11:22:52.173Z", "dateUpdated": "2026-04-08T16:48:46.336Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:46.336Z"}, "affected": [{"vendor": "ultimateblocks", "product": "Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultimate Blocks \u2013 WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Ultimate Blocks \u2013 WordPress Blocks Plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41b2a4cc-fb23-41eb-b1a4-d793ae924d9a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/how-to/block.php#L335"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/content-filter/block.php#L14"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/tabbed-content/block.php#L136"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/content-toggle/block.php#L133"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Ngoc Quang Bach"}], "timeline": [{"time": "2025-03-27T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-06-09T22:39:02.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-10T13:55:15.738253Z", "id": "CVE-2025-2918", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-10T13:59:37.592Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2918", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-10T13:55:15.738253Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-10T13:59:29.501Z"}}], "cna": {"title": "Ultimate Blocks \u2013 WordPress Blocks Plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets", "credits": [{"lang": "en", "type": "finder", "value": "Nguyen Ngoc Quang Bach"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ultimateblocks", "product": "Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.3.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-27T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-06-09T22:39:02.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41b2a4cc-fb23-41eb-b1a4-d793ae924d9a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/how-to/block.php#L335"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/content-filter/block.php#L14"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/tabbed-content/block.php#L136"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/content-toggle/block.php#L133"}], "descriptions": [{"lang": "en", "value": "The Ultimate Blocks \u2013 WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:46.336Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2918", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:48:46.336Z", "dateReserved": "2025-03-28T11:40:22.930Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-10T11:22:52.173Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor", "vendor": "ultimateblocks", "versions": [{"lessThanOrEqual": "3.3.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dotcamp:ultimate_blocks:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "66D7DA6A-A22D-477D-BF8E-5B7AE0C583CE", "versionEndExcluding": "3.3.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Blocks \u2013 WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Ultimate Blocks \u2013 WordPress Blocks Plugin para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de m\u00faltiples widgets en todas las versiones hasta la 3.3.3 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-2918", "lastModified": "2026-06-17T09:07:51.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2918", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-10T13:55:15.738253Z", "version": "2.0.3"}}]}, "published": "2025-06-10T12:15:23.867", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/content-filter/block.php#L14"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/content-toggle/block.php#L133"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/how-to/block.php#L335"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/ultimate-blocks/tags/3.2.9/src/blocks/tabbed-content/block.php#L136"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41b2a4cc-fb23-41eb-b1a4-d793ae924d9a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:22:21.355408+00:00", "value": {"mitigation_remediation": ["Update Ultimate Blocks plugin to the latest version (\u22653.4) to remove the stored XSS flaw.", "If an immediate update is not feasible, deactivate or delete the specific widgets that contain the vulnerability until a patch is applied.", "Review and tighten WordPress user roles so that only trusted administrators can edit or add content in the widget editor, limiting exposure for Contributor accounts."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting via widgets authenticated to Contributor level"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Ultimate Blocks \u2013 25+ Gutenberg Blocks for Block Editor plugin version 3.3.3 or earlier. The plugin is authored by Ultimate Blocks (dotcamp). Any installation of the plugin that includes the vulnerable widgets is at risk when that plugin is older than 3.4.", "description_and_impact": "The vulnerability is a stored XSS flaw located in multiple widgets of the Ultimate Blocks \u2013 WordPress Blocks Plugin. Unescaped user input allows an authenticated Contributor or higher to inject arbitrary JavaScript that will run in the browsers of any visitor who views the affected page. Because the script is stored, the impact can persist across sessions and affect every user who accesses the page, potentially enabling session hijacking, credential theft, or site defacement.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a medium severity. The EPSS score of <1% shows the probability of exploitation is very low at present, and the vulnerability is not listed in CISA's KEV catalog. Attackers must be authenticated and have Contributor or higher privileges to inject the payload, so the risk is limited to sites with exposed editor capabilities or insufficient role restrictions. Exploitation requires administrative access to the WordPress dashboard and the ability to edit or add content via the affected widgets."}}}}, "created": "2026-04-21T20:30:27.399887+00:00", "updated": "2026-04-21T20:30:27.399898+00:00", "vendors": []}