Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Cloud Blocks | unknown |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 05 Nov 2026 07:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-79 |
Thu, 05 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor. | |
| Title | Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSS | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-05T06:00:28.065Z
Reserved: 2026-10-06T09:28:08.317Z
Link: CVE-2025-15702
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-05T06:17:06.507
Modified: 2026-11-05T06:17:06.507
Link: CVE-2025-15702
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-05T07:30:14Z