EUVD-2025-210624
GHSA-mg54-xc87-q8w3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
PR:L corrects NVD's PR:N since Author-level authentication is required to upload files; S:C and C:L/I:L reflect cross-user session impact via stored XSS.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.
AnalysisAI
Stored Cross-Site Scripting in the Nexter Blocks WordPress plugin before 5.0.2 allows any authenticated user with file upload capability (Author role by default) to upload a malicious SVG file containing embedded JavaScript that executes in any victim's browser upon accessing the file. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) and absence from CISA KEV indicate low observed exploitation to date. The NVD-assigned CVSS PR:N conflicts with the description's clear authentication requirement - defenders should treat this as an authenticated vulnerability, which meaningfully narrows real-world exposure.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the Stored variant. SVG files are XML-based graphics formats that natively support embedded JavaScript via inline <script> blocks and event-handler attributes (e.g., onload, onclick). WordPress itself restricts SVG uploads by default, but the Nexter Blocks plugin - a Gutenberg block library extending the WordPress block editor - overrides this restriction without applying content sanitization to the uploaded SVG. When WordPress serves the SVG directly as a static file, the browser parses and executes the embedded script in the context of the WordPress domain origin, enabling session theft, credential harvesting, or DOM manipulation against any user who accesses the file URL. The affected CPE is cpe:2.3:a:unknown:nexter_blocks:*:*:*:*:*:*:*:*, covering all versions below 5.0.2; the vendor field is listed as 'unknown' in NVD, indicating product attribution is not yet finalized.
RemediationAI
Update the Nexter Blocks plugin to version 5.0.2 or later - this is the vendor-released patch that resolves the missing SVG sanitization, confirmed by WPScan and EUVD data. If immediate patching is not possible, restrict file upload capability for the Author role using a WordPress capability management plugin such as Members or User Role Editor to remove the upload_files capability from untrusted roles; note this will prevent Authors from uploading any media, breaking standard editorial workflows. Alternatively, block SVG MIME type uploads entirely by adding SVG to a blocked file-type list via a security plugin such as Wordfence or by modifying upload filters - this disables all SVG content site-wide. After patching or applying controls, audit the WordPress media library for existing SVG uploads and inspect their content for malicious <script> tags or event-handler attributes. See https://wpscan.com/vulnerability/2405c1ef-844a-462b-8329-c09d33b255b2/ for advisory details.
More in Nexter Blocks
View allNexter Blocks WordPress plugin versions through 4.7.0 expose sensitive system information to unauthenticated remote atta
Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor.2.5. Rated medium severit
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today