We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2025-15678

CVE-2025-15678

WordPress

Severity: MEDIUM
CVSS: 6.1CVSS
Published: 2026-08-06
Last modified: 2026-08-06
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79

Description

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.

References

https://wpscan.com/vulnerability/2405c1ef-844a-462b-8329-c09d33b255b2/

Summary

Description

References