CVE-2025-1291

Summary

CVE-2025-1291 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Gutenberg Blocks with AI plugin for WordPress, specifically versions 3.4.9 and below. This issue, which arises from insufficient input sanitization and output escaping, permits authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. Such scripts will execute whenever a user accesses a manipulated page. This flaw poses a significant security risk, allowing attackers to potentially steal user data or take control of affected websites.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.