CVE-2025-5950

IndieBlocks <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter

Published Jun 13, 2025 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

Technical impact

The IndieBlocks WordPress plugin is vulnerable to a stored cross‑site scripting flaw that allows an authenticated user with Contributor or higher privileges to insert malicious JavaScript via the kind parameter; the payload is saved and executed whenever any page containing the injected content is viewed.

Affected Systems

WordPress sites using the IndieBlocks plugin from janboddez, versions up to and including 0.13.2 are affected. The vulnerability exists in every release within that range regardless of additional configuration.

Risk and Exploitability

The flaw has a CVSS score of 6.4, indicating moderate severity, and an EPSS below 1%, suggesting exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. It is exploitable only by users who have authenticated access with Contributor or higher role, and the malicious code will run in the context of any visitor to the impacted page.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

janboddez

IndieBlocks

unaffected

Version	Status	Constraints
`0`	affected	≤ 0.13.2

Configuration 1 [-]

cpe:2.3:a:janboddez:indieblocks:*:*:*:*:*:wordpress:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update IndieBlocks to the latest available version through the WordPress plugin repository.
If an upgrade is not possible, disable the IndieBlocks plugin or remove the functionality that registers the kind parameter until the plugin can be updated.
As an interim measure, restrict Contributor and higher roles from editing pages that render IndieBlocks content, or remove any stored content that could carry the payload.

Generated by OpenCVE AI on April 22, 2026 at 01:22 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-18238	The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.265% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/indieblocks/trunk/blocks/facepile-content/render.php#L39
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3311358%40indieblocks&new=3311358%40indieblocks&sfp_email=&sfph_mail=
https://wordpress.org/plugins/indieblocks/#developers
https://www.wordfence.com/threat-intel/vulnerabilities/id/41fdb3ea-1de4-4b90-a387-5932de7a5e7c?source=cve

History

Apr 8, 2026 5:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3311358%40indieblocks&new=3311358%40indieblocks&sfp_email=&sfph_mail=

Jul 15, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.0003}`	epss `{'score': 0.00035}`

Jul 10, 2025 1:00 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Janboddez Janboddez indieblocks
CPEs		cpe:2.3:a:janboddez:indieblocks::::::wordpress::*
Vendors & Products		Janboddez Janboddez indieblocks

Jun 13, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 13, 2025 2:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title		IndieBlocks <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter
Weaknesses		CWE-79
References		https://plugins.trac.wordpress.org/browser/indieblocks/trunk/blocks/facepile-content/render.php#L39 https://wordpress.org/plugins/indieblocks/#developers https://www.wordfence.com/threat-intel/vulnerabilities/id/41fdb3ea-1de4-4b90-a387-5932de7a5e7c?source=cve
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`