What is the CVSS score of CVE-2025-62940?

CVE-2025-62940 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Blox Lite CVE-2025-62940

Q: Which versions of Blox Lite are affected by CVE-2025-62940?

Stored cross-site scripting (XSS) in the Blox Lite WordPress plugin (version <= 1.2.8) allows authenticated users with content creation privileges to inject arbitrary web scripts.

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-27 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Stored XSS requiring low-privilege attacker to submit content, admin to view, scope change, low impacts.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:R/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:21 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Diego Blox Lite blox-lite allows Stored XSS.This issue affects Blox Lite: from n/a through <= 1.2.8.

AnalysisAI

Stored cross-site scripting (XSS) in the Blox Lite WordPress plugin (version <= 1.2.8) allows authenticated users with content creation privileges to inject arbitrary web scripts. When an administrator or high-privilege user views the affected content, the injected script executes in their browser, potentially leading to session hijacking, site defacement, or phishing. The vulnerability has a low EPSS score (0.02%) and no evidence of active exploitation, though public exploit code may be possible given the nature of XSS.

Technical ContextAI

The vulnerability is a stored cross-site scripting (CWE-79) in a WordPress plugin, likely due to improper output sanitization of user-submitted content in a page-building block. The Blox Lite plugin, as indicated by the CPE string cpe:2.3:a:nickdiego:blox_lite:*:*:*:*:*:wordpress:*:*, processes user input that is stored and later rendered without adequate escaping. When the crafted input is viewed, the browser executes the injected script in the security context of the victim, leading to the scope change (S:C) and low confidentiality, integrity, and availability impacts on the vulnerable application.

Affected ProductsAI

Blox Lite plugin for WordPress versions from n/a through 1.2.8 are affected, as reported by Patchstack (advisory: https://patchstack.com/database/Wordpress/Plugin/blox-lite/vulnerability/wordpress-blox-lite-plugin-1-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve). The affected CPE is cpe:2.3:a:nickdiego:blox_lite:*:*:*:*:*:wordpress:*:* with versions up to and including 1.2.8.

RemediationAI

Update the Blox Lite plugin to a version greater than 1.2.8, as the patch likely introduces proper output escaping. The exact fix version is not stated in the advisory, but upgrades beyond the affected range close the vulnerability. If an update is unavailable, consider temporarily disabling the plugin; as a compensating control, restrict content editing capabilities to fully trusted users and audit any existing content for malicious scripts. Note that disabling the plugin will remove its block-editor features.