In April 2025, a stored Cross-Site Scripting (XSS) vulnerability was identified in the popular Qi Blocks WordPress plugin, specifically affecting versions below 1.4. This vulnerability, now tracked as CVE-2025-1627, allows a user with Contributor permissions to inject malicious scripts into the site using the Table of Contents (ToC) block. Once a malicious payload is stored, it gets executed every time a visitor loads the affected page — putting both site administrators and end users at risk.
| CVE | CVE-2025-1627 |
| Plugin | Qi Blocks < 1.4 |
| Critical | High |
| All Time | 533 058 |
| Active installations | 60 000+ |
| Publicly Published | April 30, 2025 |
| Last Updated | April 30, 2025 |
| Researcher | Artyom Krugov |
| OWASP TOP-10 | A7: Cross-Site Scripting (XSS) |
| PoC | Yes |
| Exploit | No |
| Reference | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1627 https://wpscan.com/vulnerability/31b2292b-1ea7-4d63-ad65-0366e2c05dd3/ |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| February 12, 2025 | Plugin testing and vulnerability detection in the QI Blocks have been completed |
| February 12, 2025 | I contacted the author of the plugin and provided a vulnerability PoC with a description and recommendations for fixing |
| April 30, 2025 | Registered CVE-2025-1627 |
Discovery of the Vulnerability
The vulnerability was discovered during a routine plugin security audit focused on Gutenberg block extensions. Security researchers found that the Title field in the ToC block improperly handled user input and failed to sanitize or encode it correctly. This oversight allowed users with minimal privileges, like Contributors, to inject persistent JavaScript payloads through double-encoded HTML input. The issue was reported to the developers, who addressed it in version 1.4.
Understanding of XSS attack’s
Stored XSS (also called persistent XSS) occurs when malicious input from a user is stored on the server and later rendered as part of the webpage without proper sanitization or encoding. Unlike reflected XSS, stored XSS doesn’t require the victim to click a crafted URL — the attack payload is persistently embedded in content. In WordPress, common targets for stored XSS include post titles, custom fields, comments, and plugin-generated content such as Gutenberg blocks. For example, if a plugin allows users to enter HTML into a block and fails to sanitize it, attackers can inject <script> tags or image tags with onerror events to execute JavaScript when the page loads.
Exploiting the XSS Vulnerability
To exploit CVE-2025-1627, an attacker only needs Contributor privileges on a vulnerable WordPress site with Qi Blocks < 1.4 installed. The steps are:
POC:
1. Log in as a Contributor. 2. Create or edit a post. 3. Insert the Table of Contents (ToC) block. 4. In the block's Title field, inject a double HTML-encoded XSS payload such as: "&gt;&lt;script&gt;&lt;/script&gt;&lt;img src=x onerror=alert(777)&gt; 5. Publish or submit the post. 6. When the post is viewed in either the admin area or publicly (depending on site settings), the payload is decoded and executed, triggering JavaScript like alert(777).____
This exploit demonstrates how minimal access levels can be leveraged for significant compromise if proper input handling is neglected.
Recommendations for Improved Security
To mitigate the risks posed by CVE-2025-1627, administrators must update the Qi Blocks plugin to version 1.4 or later. Developers should implement strong input validation and output encoding mechanisms, particularly in user-configurable fields like the ToC block title. Using WordPress’s built-in functions such as sanitize_text_field(), esc_html(), and wp_kses_post() can prevent injection of executable code. A Content Security Policy (CSP) should also be enforced to limit script execution and reduce the impact of XSS. Additionally, Contributor roles should be limited in scope — especially their ability to use advanced blocks or publish unreviewed content. Regular user role audits and plugin security reviews are key to maintaining a secure WordPress environment. Following these measures, the plugin vendor has resolved this issue by applying our recommended mitigation techniques focused on safe input handling and output rendering. To prevent this type of attacks vendor used our methods of prevention.
By taking proactive measures to address Stored XSS vulnerabilities like CVE-2025-1627, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.
#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability
Use CleanTalk solutions to improve the security of your website
Artyom k.