CVE-2025-26937

Summary

CVE-2025-26937 is a Cross-site Scripting (XSS) vulnerability affecting the Icon List Block in bPlugins from versions n/a through 1.1.3. An attacker can exploit this Improper Neutralization of Input vulnerability during web page generation and inject malicious scripts into a victim's browser. This can lead to unauthorized access, data theft, or other potential security risks. Users are strongly advised to update the Icon List Block to a secure version to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.