Nexter Blocks < 5.0.2 – Author+ Stored XSS via SVG Upload | CVE 2025-15678

Description

The plugin does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting.

Proof of Concept

Prerequisite: an Author-level account (Author has the upload_files capability by default).

1. Save the following as poc.svg:

<svg xmlns="http://www.w3.org/2000/svg" width="500" height="150" onload="alert(document.domain)">
  <script>alert(document.domain)</script>
</svg>

2. Log in as the Author user.
3. Go to Media > Add New Media File and upload poc.svg. The upload succeeds because the plugin globally adds image/svg+xml to the allowed upload MIME types with no sanitization and no role restriction.
4. Open the uploaded file's URL directly in a browser, e.g. https://victim.example/wp-content/uploads/YYYY/MM/poc.svg . The file is served as Content-Type: image/svg+xml and the embedded JavaScript executes in the site's origin. If an authenticated administrator opens the URL, the script runs in their session and can drive privileged wp-admin actions.