CVE-2025-26937

WordPress Icon List Block plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Feb 25, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.1.3.

Analysis

AI-generated

Technical impact

The flaw allows malicious JavaScript to be stored in icon list items and served to any visitor who views the page. This stored cross-site scripting (XSS) flaw could enable arbitrary script execution in user browsers.

Affected Systems

All releases of the Icon List Block WordPress plugin through version 1.1.3 are affected; administrators using these versions must treat the plugin as vulnerable.

Risk and Exploitability

With a CVSS base score of 6.5 the vulnerability presents moderate risk, and its EPSS score of < 1 % indicates a low exploitation probability; it is not listed in CISA’s KEV catalog. The CVE description does not specify the privilege level required to inject content; however, once malicious code is stored it executes in the browsers of all visitors who load the affected content.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Icon List Block plugin to a release newer than 1.1.3 where input sanitisation has been fixed.
  • Disable or remove the plugin from any sites that cannot be upgraded immediately, and delete all stored list entries that may contain malicious content.
  • Implement a strong content‑security policy that disallows inline scripts and restricts executable code origins to mitigate any residual XSS vectors.

Generated by OpenCVE AI on May 2, 2026 at 09:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-5436 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block allows Stored XSS. This issue affects Icon List Block: from n/a through 1.1.3.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block allows Stored XSS. This issue affects Icon List Block: from n/a through 1.1.3. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.1.3.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block allows Stored XSS. This issue affects Icon List Block: from n/a through 1.1.3.
Title WordPress Icon List Block plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Feb 17, 2025, 11:51 AM

View source JSON

Updated
Feb 25, 2025, 3:06 PM

JSON

Status
Deferred
Published
Feb 25, 2025, 3:15 PM
Modified
Jun 17, 2026, 9:02 AM

View source JSON

No data.

Updated
May 2, 2026, 9:15 AM

JSON