CVE-2025-9075
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to and including 2.3.10 due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts.
Risk Assessment
Authenticated attackers with Contributor-level access and above can inject malicious scripts that execute when users visit pages, potentially leading to data theft or account takeover.
Recommendation
It is recommended to update the plugin to a version above 2.3.10 and implement proper sanitization and escaping mechanisms for all block attributes.
Other vulnerabilities in ZoloBlocks
See all- CVE-2025-12134Medium
The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_popup_status() function in all versions up to and including 2.3.11. This allows unauthenticated attackers to enable or disable popups.
- CVE-2025-49903Medium
The ZoloBlocks plugin up to version 2.3.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access to functionality.
- CVE-2025-60161Medium
Server-Side Request Forgery (SSRF) vulnerability in bdthemes ZoloBlocks zoloblocks allows Server Side Request Forgery. This issue affects ZoloBlocks from n/a through <= 2.3.11.
Original NVD description (English source)
The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to, and including, 2.3.10. This is due to insufficient input sanitization and output escaping on user-supplied attributes within multiple block components including Google Maps markers, Lightbox captions, Image Gallery data attributes, Progress Pie prefix/suffix fields, and Text Path URL fields. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS