CVE-2025-4684: BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets
The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of Image Carousel and Image Slider widgets in all versions up to, and including, 3.2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4684?
CVE-2025-4684 is classified as a medium severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2025-4684?
To mitigate CVE-2025-4684, update the BlockSpare plugin to version 3.2.13.2 or later.
Which versions of BlockSpare are affected by CVE-2025-4684?
CVE-2025-4684 affects BlockSpare Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites versions up to and including 3.2.13.1.
What kind of attacks can CVE-2025-4684 lead to?
CVE-2025-4684 can lead to Stored Cross-Site Scripting, allowing attackers to inject malicious scripts into web pages viewed by users.
Is CVE-2025-4684 specific to certain configurations?
CVE-2025-4684 is specific to the BlockSpare plugin for WordPress and is not dependent on other configurations or plugins.