CVE-2025-15678— Nexter Blocks < 5.0.2 - Author+ Stored XSS via SVG Upload
Quick assessment
Affected
Unknown Nexter Blocks
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress Nexter Blocks是WordPress基金会开源的一款网站页面构建组件。 WordPress Nexter Blocks 5.0.2之前版本存在跨站脚本漏洞，该漏洞源于对上传的SVG文件未进行清理，允许任何能上传文件的用户（默认为作者）上传包含恶意JavaScript的文件，当访问该文件时执行，导致存储型跨站脚本。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Nexter Blocks | < 5.0.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-15678
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nexter Blocks < 5.0.2 - Author+ Stored XSS via SVG Upload
Source: CVE Program / CVE List V5
Vulnerability Description
The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Nexter Blocks 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Nexter Blocks是WordPress基金会开源的一款网站页面构建组件。 WordPress Nexter Blocks 5.0.2之前版本存在跨站脚本漏洞，该漏洞源于对上传的SVG文件未进行清理，允许任何能上传文件的用户（默认为作者）上传包含恶意JavaScript的文件，当访问该文件时执行，导致存储型跨站脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Nexter Blocks | 0 ~ 5.0.2 | - |
|
II. Public POCs for CVE-2025-15678
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-15678
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-15678 (1)
-
🔗 Nexter Blocks < 5.0.2 – Author+ Stored XSS via SVG Upload | CVE 2025-15678 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-06 · 49 CVEs total
| CVE-2026-11976 | 10.0 CRITICAL | MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise |
| CVE-2026-14812 | 10.0 CRITICAL | Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection) |
| CVE-2026-17032 | 9.8 CRITICAL | Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server |
| CVE-2026-3430 | 8.6 HIGH | Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi |
| CVE-2026-10599 | 7.5 HIGH | Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transacti |
| CVE-2026-12584 | 7.5 HIGH | Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmati |
| CVE-2026-13399 | 7.5 HIGH | Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse |
| CVE-2026-10524 | 7.5 HIGH | CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation |
| CVE-2026-16620 | 7.5 HIGH | WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Selec |
| CVE-2026-16619 | 7.5 HIGH | miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts |
| CVE-2026-5336 | 6.8 MEDIUM | Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Infor |
| CVE-2026-12901 | 5.9 MEDIUM | GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verificati |
| CVE-2026-11361 | 5.9 MEDIUM | Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Sub |
| CVE-2026-15152 | 5.3 MEDIUM | WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass |
| CVE-2026-14831 | 5.3 MEDIUM | Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass |
| CVE-2026-13342 | 5.3 MEDIUM | Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist |
| CVE-2026-15149 | 5.3 MEDIUM | WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation |
| CVE-2026-16067 | 5.3 MEDIUM | Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via C |
| CVE-2026-15147 | 5.3 MEDIUM | Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Co |
| CVE-2026-15208 | 5.3 MEDIUM | RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verif |
Showing top 20 of 49 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Nexter Blocks
-
CVE-2026-17011
Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection -
CVE-2026-39516
WordPress Nexter Blocks plugin <= 4.7.0 - Sensitive Data Exp -
CVE-2024-50452
WordPress Nexter Blocks plugin <= 3.3.3 - Cross Site Scripti -
CVE-2026-24377
WordPress Nexter Blocks plugin <= 4.6.3 - Sensitive Data Exp -
CVE-2025-54739
WordPress Nexter Blocks Plugin <= 4.5.4 - Broken Access Cont
Same vendor: Unknown
-
CVE-2026-19856
All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortco -
CVE-2026-92924
Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbi -
CVE-2026-97219
MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via -
CVE-2026-91020
WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticat -
CVE-2026-90987
Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenti
V. Comments for CVE-2025-15678
No comments yet