EUVD-2025-19355Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Requires authenticated Contributor access (PR:L); network vector, low complexity; impacts limited to low confidentiality and integrity with scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Osom Blocks - Custom Post Type listing block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Osom Blocks WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the class_name parameter, executing whenever a user views the compromised page. The vulnerability affects all versions up to 1.2.1 and carries a CVSS score of 6.4 (Medium) with an EPSS probability of 0.04%, indicating low exploitation likelihood. No active exploitation (KEV) or public exploit code has been identified at this time.
Technical ContextAI
The vulnerability exists in the Osom Blocks WordPress plugin, which provides a custom post type listing block via the Gutenberg editor. It stems from insufficient input sanitization and output escaping on the 'class_name' parameter, leading to Stored Cross-Site Scripting (CWE-79). The affected CPE is cpe:2.3:a:osompress:osom_blocks:*:*:*:*:*:wordpress:*:*, indicating the plugin is designed for WordPress environments. The flaw allows authenticated users to store malicious JavaScript that executes in the context of other users' browsers when they access the page, typical of stored XSS in WordPress plugins.
RemediationAI
Update the Osom Blocks plugin to version 1.2.2 or later (if released) by obtaining the latest version from the WordPress plugin directory (https://wordpress.org/plugins/osomblocks/#developers). Alternatively, apply the patch from the referenced Trac changeset manually. As a workaround, restrict the Contributor role or disable the plugin until patched. No specific side effects are anticipated from updating, but disabling the plugin would remove the custom post type listing block functionality.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today