CVE-2025-22644

WordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Mar 27, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce vayu-blocks allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through <= 1.4.7.

Analysis

AI-generated

Technical impact

The vulnerability is an improper neutralization of input during web page generation, allowing attackers to store malicious scripts that will run when other users view affected pages. It is identified as CWE‑79 and results in stored cross‑site scripting.

Affected Systems

WordPress sites running ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce versions up to and including 1.4.7 are affected. There is no broader vendor scope beyond this plugin.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web‑based, where an attacker can inject harmful payloads that persist in stored content and execute when rendered by any user’s browser.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce to a version newer than 1.4.7
  • If an immediate upgrade is not feasible, disable the plugin or remove any user‑input forms that deliver content to the front‑end until a patch is applied
  • Configure a Web Application Firewall to block typical XSS payloads and monitor for suspicious activity

Generated by OpenCVE AI on May 2, 2026 at 03:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-8474 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through 1.2.1.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through 1.2.1. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce vayu-blocks allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through <= 1.4.7.
Title WordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability WordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
First Time appeared Themehunk
Themehunk vayu Blocks
CPEs cpe:2.3:a:themehunk:vayu_blocks:*:*:*:*:*:wordpress:*:*
Vendors & Products Themehunk
Themehunk vayu Blocks
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce allows Stored XSS.This issue affects Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce: from n/a through 1.2.1.
Title WordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Jan 7, 2025, 9:02 PM

View source JSON

Updated
Mar 27, 2025, 3:42 PM

JSON

Status
Modified
Published
Mar 27, 2025, 3:15 PM
Modified
Jun 17, 2026, 8:48 AM

View source JSON

No data.

Updated
May 2, 2026, 3:15 AM

JSON