CVE-2025-9075 – The ZoloBlocks WordPress plugin has a stored cr... (How to Fix)

Q: What is the severity of CVE-2025-9075?

CVE-2025-9075 has a CVSS score of 6.4 (MEDIUM). The ZoloBlocks WordPress plugin has a stored cross-site scripting vulnerability that allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute when users visit the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using ZoloBlocks version 2.3.10 or earlier are affected.

📋 TL;DR

The ZoloBlocks WordPress plugin has a stored cross-site scripting vulnerability that allows authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. These scripts execute when users visit the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using ZoloBlocks version 2.3.10 or earlier are affected.

💻 Affected Systems

Products:

ZoloBlocks WordPress Plugin

Versions: Up to and including version 2.3.10

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with ZoloBlocks plugin enabled. Contributor-level access or higher needed for exploitation.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, take over the WordPress site, install backdoors, deface the site, or redirect visitors to malicious sites.

🟠

Likely Case

Attackers with contributor access inject malicious scripts to steal user session cookies, perform actions as authenticated users, or display phishing content.

🟢

If Mitigated

With proper user access controls and content security policies, impact is limited to potential data leakage from users viewing compromised pages.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is technically simple once access is obtained.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 2.3.11 or later

Vendor Advisory: https://wordpress.org/plugins/zoloblocks/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find ZoloBlocks and click 'Update Now'. 4. Verify update to version 2.3.11 or later.

🔧 Temporary Workarounds

Disable ZoloBlocks Plugin

all

Temporarily disable the vulnerable plugin until patching is possible

wp plugin deactivate zoloblocks

Restrict User Roles

all

Temporarily remove contributor-level access for untrusted users

🧯 If You Can't Patch

Implement Content Security Policy (CSP) headers to restrict script execution
Regularly audit user accounts and remove unnecessary contributor-level access

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → ZoloBlocks version. If version is 2.3.10 or earlier, you are vulnerable.

Check Version:

wp plugin get zoloblocks --field=version

Verify Fix Applied:

After updating, verify ZoloBlocks version is 2.3.11 or later in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual content modifications by contributor-level users
Multiple failed login attempts followed by successful contributor login

Network Indicators:

Unexpected script tags in page responses containing ZoloBlocks content
External script loads from unexpected domains

SIEM Query:

source="wordpress.log" AND ("zoloblocks" OR "contributor") AND ("update" OR "inject" OR "script")

📊 Metadata

CVE ID: CVE-2025-9075

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.07% exploit probability (20.3th percentile)

Published: October 1, 2025

Last Updated: October 2, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-9075, you might also want to check these: