CVE-2025-15678

Nexter Blocks < 5.0.2 - Author+ Stored XSS via SVG Upload

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.

Affected

Nexter Blocks

CVSS v3.1 CNA

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.25% chance of exploitation in the next 30 days, 16th percentile

Published

2026-08-06

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/2405c1ef-844a-462b-8329-c09d33b255b2/

References

• CVE Record
• NVD entry