CVE-2025-4685: Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML data attributes of multiple widgets, in all versions up to, and including, 3.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4685?
CVE-2025-4685 has a medium severity rating due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2025-4685?
To fix CVE-2025-4685, update the Gutentor – Gutenberg Blocks plugin to version 3.4.9 or later.
Which versions are affected by CVE-2025-4685?
CVE-2025-4685 affects all versions of the Gutentor – Gutenberg Blocks plugin up to and including version 3.4.8.
What type of vulnerability is CVE-2025-4685?
CVE-2025-4685 is a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization.
Who is the vendor associated with CVE-2025-4685?
The vendor associated with CVE-2025-4685 is Gutentor.