CVE-2025-5923

Game Review Block <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

Published Jun 13, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The Game Review Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The Game Review Block plugin for WordPress is vulnerable to stored cross‑site scripting through the className parameter in all versions up to 4.8.1. Insufficient input sanitization and output escaping allow an attacker who has at least Contributor level access to inject arbitrary web scripts that will execute whenever another user views the injected page. This flaw can be used to deface content, steal user credentials, or perform other malicious actions within the site’s authenticated context.

Affected Systems

Marcdk’s Game Review Block plugin for WordPress, versions 4.8.1 and earlier, is affected. Any installation of these versions must be verified and updated.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1% suggests exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires a user with Contributor or higher privileges to inject the payload; from that point the scripts run with the privileges of the affected site visitor. The lack of broader access permissions limits the scope to authenticated users who view compromised pages.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

marcdk

Game Review Block

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.8.1

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Game Review Block plugin to the latest available version (4.8.2 or later).
If an upgrade is not immediately possible, revoke or downgrade Contributor privileges for users that can edit blocks until the patch is applied.
After applying the patch, perform a site‑wide audit of blocks to confirm no residual malicious scripts remain.

Generated by OpenCVE AI on April 21, 2026 at 20:16 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-18255	The Game Review Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.292% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/mtoensing/game-review-block/commit/135aa118b75db5242df7fd1ef13cc09ec3410f3a
https://plugins.trac.wordpress.org/browser/game-review-block/tags/4.7.0/src/game-table/callback.php#L38
https://wordpress.org/plugins/game-review-block/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/88520d8e-8e13-4b58-9df3-3b99afd39144?source=cve

History

Jul 15, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00034}`	epss `{'score': 0.00039}`

Jun 13, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 13, 2025 7:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Game Review Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		Game Review Block <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
Weaknesses		CWE-79
References		https://github.com/mtoensing/game-review-block/commit/135aa118b75db5242df7fd1ef13cc09ec3410f3a https://plugins.trac.wordpress.org/browser/game-review-block/tags/4.7.0/src/game-table/callback.php#L38 https://wordpress.org/plugins/game-review-block/#developers https://www.wordfence.com/threat-intel/vulnerabilities/id/88520d8e-8e13-4b58-9df3-3b99afd39144?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`