CVE-2025-31077: 
WordPress vulnerability analysis and mitigation

A DOM-Based Cross-site Scripting (XSS) vulnerability was discovered in Ultimate Blocks WordPress plugin, affecting versions through 3.2.7. The vulnerability was identified and published on March 28, 2025, and assigned identifier CVE-2025-31077 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') issue. It has been assigned a CVSS v3.1 score of 6.5 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability falls under the OWASP Top 10 category A3: Injection (Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site. The impact is considered to have low severity but affects confidentiality, integrity, and availability of the system (Patchstack).

The vulnerability requires Contributor-level privileges or higher to exploit. It was initially reported on January 21, 2025, by researcher 'zaim' and was officially published on March 28, 2025 (Patchstack).

The vulnerability has been fixed in version 3.2.8 of the Ultimate Blocks plugin. Users are advised to update to version 3.2.8 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).