CVE-2025-64383

MediumCVSS 6.5

Published: 13/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

Stored Cross-Site Scripting (XSS) vulnerability in Qi Blocks (versions up to 1.4.3). Allows an attacker to inject a persistent script that executes in the victim's browser.

Risk Assessment

Risk of session theft, account takeover, or unauthorized actions performed on behalf of the victim.

Recommendation

Update Qi Blocks to the latest available version that includes XSS fixes.

Other vulnerabilities in Qi Blocks

CVE-2026-10096Medium
The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in versions up to and including 1.4.9. Missing validation on the 'page_id' parameter allows authenticated attackers with author-level access or higher to modify Qi Blocks styles of arbitrary posts, templates, or widgets they do not own, including site-wide surfaces via reserved 'template' and 'widget' values.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks allows Stored XSS.This issue affects Qi Blocks: from n/a through <= 1.4.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS