What is the CVSS score of CVE-2025-5950?

CVE-2025-5950 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of IndieBlocks are affected by CVE-2025-5950?

Organizations using all should be aware of moderate risk from CVE-2025-5950, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2025-5950?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

IndieBlocks CVE-2025-5950

EUVD-2025-18238 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-06-13 security@wordfence.com

WordPress XSS Indieblocks Wordpress Plugin

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

PR:L due to Contributor role required; scope changed to browser.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 13:27 vuln.today

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18238

CVE Published

Jun 13, 2025 - 03:15 nvd

MEDIUM 6.4

DescriptionCVE.org

The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting (XSS) in IndieBlocks WordPress plugin up to version 0.13.2 allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the 'kind' parameter. These scripts execute when any user visits an affected page. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).

Technical ContextAI

The vulnerability is a Stored XSS (CWE-79) in the IndieBlocks plugin for WordPress, specifically in the 'kind' parameter used in the facepile-content block. The plugin fails to properly sanitize input and escape output, allowing stored scripts. CPE data confirms all versions up to 0.13.2 are affected. The attack vector is network-based with low complexity, requiring low privileges (Contributor-level) and no user interaction, but scope changes to the browser context.

RemediationAI

Upgrade IndieBlocks plugin to version 0.13.3 or later, which contains the fix. The patch is available in the WordPress plugin repository and Trac changeset. No workarounds are documented; however, limiting Contributor-level access to trusted users can reduce risk. Side effect: upgrading may require testing for compatibility with existing content.