CVE-2025-8607

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8607", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-05T19:07:48.033Z", "datePublished": "2025-08-21T05:28:14.610Z", "dateUpdated": "2026-04-08T17:21:35.793Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:35.793Z"}, "affected": [{"vendor": "amans2k", "product": "SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block's attributes in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c88c6ad8-d4bd-4785-a6e7-e5034c58158b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3347030%40slingblocks%2Ftrunk&old=3275990%40slingblocks%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-08-11T12:24:37.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-20T16:47:39.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-21T14:53:44.887439Z", "id": "CVE-2025-8607", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-21T14:53:51.305Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8607", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-21T14:53:44.887439Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-21T14:53:47.964Z"}}], "cna": {"title": "SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "amans2k", "product": "SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-11T12:24:37.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-20T16:47:39.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c88c6ad8-d4bd-4785-a6e7-e5034c58158b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3347030%40slingblocks%2Ftrunk&old=3275990%40slingblocks%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block's attributes in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:35.793Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8607", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:35.793Z", "dateReserved": "2025-08-05T19:07:48.033Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-21T05:28:14.610Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels)", "vendor": "amans2k", "versions": [{"lessThanOrEqual": "1.6.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block's attributes in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento SlingBlocks \u2013 Gutenberg Blocks de FunnelKit (anteriormente WooFunnels) para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de los atributos del bloque Countdown del complemento en todas las versiones hasta la 1.6.0 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-8607", "lastModified": "2026-06-17T10:07:18.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8607", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-21T14:53:44.887439Z", "version": "2.0.3"}}]}, "published": "2025-08-21T06:15:35.600", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3347030%40slingblocks%2Ftrunk&old=3275990%40slingblocks%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c88c6ad8-d4bd-4785-a6e7-e5034c58158b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:54:47.520407+00:00", "value": {"mitigation_remediation": ["Upgrade the SlingBlocks plugin to a version newer than 1.6.0 where the sanitization issue has been fixed.", "If an upgrade is not immediately possible, remove the plugin or disable the Countdown block to prevent further script injection until a patch is applied.", "Review and restrict contributor\u2011level permissions to limit the number of users who can edit content, and enforce stricter role management to reduce the attack surface."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting that can be leveraged by authenticated users with contributor privileges or higher"}, "threat_synthesis": {"affected_systems": "The affected product is the SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels) WordPress plugin, versions up to and including 1.6.0. All WordPress sites that install these versions and use the Countdown block are impacted.", "description_and_impact": "This vulnerability is a stored cross\u2011site scripting flaw in the SlingBlocks \u2013 Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin. It is a CWE\u201179 type weakness where user\u2011supplied attributes for the plugin\u2019s Countdown block are neither sanitized nor properly escaped when stored. As a result, any authenticated user with contributor\u2011level access or higher can embed arbitrary JavaScript into a page. When visitors load the affected page, the injected scripts will execute within their browsers, potentially altering page content or injecting additional malicious code.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. However, because the attack requires only contributor\u2011level access, an attacker with a compromised or malicious contributor account can quickly insert harmful scripts into site pages. The impact is limited to the browsers of visitors who view the injected page, but the injected script could alter page content or deface the site."}}}}, "created": "2025-08-21T12:58:56.021264+00:00", "updated": "2026-04-22T01:00:04.363451+00:00", "vendors": ["funnelkit", "funnelkit$PRODUCT$slingblocks", "wordpress", "wordpress$PRODUCT$wordpress"]}