CVE-2025-15678
Last modified
CVE-2025-15678 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Nexter Blocks | < 5.0.2 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2025-15678?
How severe is CVE-2025-15678?
How do I fix CVE-2025-15678?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-15669The Bit Form WordPress plugin before 3.1.4 does not sanitis…4.8
- CVE-2025-15672The ChamaWP WordPress plugin before 1.0.13 does not properl…8.1
- CVE-2025-15673The Import and export users and customers WordPress plugin b…4.9
- CVE-2025-15674The Passster WordPress plugin before 4.3.7 does not restrict…2.7
- CVE-2025-15675The Charitable WordPress plugin before 1.8.5.3 does not san…4.8
- CVE-2025-15677The GeoDirectory WordPress plugin before 2.8.110 does not s…3.5
- CVE-2025-1568Access Control Vulnerability in Gerrit chromiumos project co…8.8
- CVE-2025-15680TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on th…2.4
- CVE-2025-15681TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication byp…9.2
- CVE-2025-15682TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated re…8.7
- CVE-2025-15683TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthentica…8.8
- CVE-2025-15684A vulnerability was detected in Open5GS up to 2.7.6. Affecte…5.3
Are you affected by CVE-2025-15678?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST