CVE-2025-9075: 
WordPress vulnerability analysis and mitigation

The ZoloBlocks plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-9075) affecting versions up to and including 2.3.10. The vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes within multiple block components including Google Maps markers, Lightbox captions, Image Gallery data attributes, Progress Pie prefix/suffix fields, and Text Path URL fields (NVD).

The vulnerability is caused by inadequate validation and sanitization of user input in several Gutenberg block components. The affected components include Google Maps markers, Lightbox captions, Image Gallery data attributes, Progress Pie prefix/suffix fields, and Text Path URL fields. The CVSS v3.1 base score is 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to theft of sensitive information or manipulation of page content (NVD).