CVE-2025-15678: Nexter Blocks < 5.0.2 - Author+ Stored XSS via SVG Upload
Published Aug 6, 2026
·Updated
The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.
Affected Software
1 affected component
WordPress Nexter Blocks<5.0.2
Event History
Aug 6, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-15678?
CVE-2025-15678 has a risk score of 48, indicating a moderate severity vulnerability.
2
How do I fix CVE-2025-15678?
To fix CVE-2025-15678, upgrade the Nexter Blocks plugin to version 5.0.2 or later.
3
Who is affected by CVE-2025-15678?
CVE-2025-15678 affects any WordPress site using the Nexter Blocks plugin versions before 5.0.2.
4
What type of vulnerability is CVE-2025-15678?
CVE-2025-15678 is a Stored Cross-Site Scripting (XSS) vulnerability.
5
What causes CVE-2025-15678?
CVE-2025-15678 is caused by the lack of sanitization for uploaded SVG files in the Nexter Blocks plugin.