---
id: CVE-2025-15702
title: Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSS
summary: >-
  The Cloud Blocks WordPress plugin through 1.1.8 does not perform any
  authorisation or sanitisation when storing block asset URLs, allowing
  unauthenticated users to store malicious scripts that are executed in the
  browser of any privilege…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-79
product: Cloud Blocks
affected:
  - cloud_blocks <= 1.1.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T11:55:20.442866Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:08:45.452Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-15702'
references:
  - url: 'https://wpscan.com/vulnerability/586f975b-1448-4ff5-b030-aa7bcdd45318/'
tags:
  - cve.org
epss: 0.00276
epssPercentile: 0.2012
ingestedAt: '2026-11-05T21:36:00.786Z'
---

## Overview

The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.

## Affected

- `cloud_blocks <= 1.1.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.