CVE-2025-1312
CVSS 3.1 Score 6.4 of 10 (medium)
Details
Published Mar 26, 2025
Updated: Mar 27, 2025
CWE ID 79
Summary
CVE-2025-1312: The WordPress plugin "Ultimate Blocks – WordPress Blocks Plugin" is susceptible to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in its 'buttonTextColor' parameter. This vulnerability affects all versions up to and including 3.2.7, allowing authenticated attackers with Contributor-level access or higher to inject malicious scripts. These scripts will execute whenever a user accesses an injected page, posing a significant security risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.