CVE-2025-15021: Gotham Block Extra Light XSS Vulnerability

CVE-2025-15021 Overview

The Gotham Block Extra Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via admin settings in all versions up to, and including, 1.5.0. This vulnerability stems from insufficient input sanitization and output escaping within the plugin's administrative interface, allowing authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages.

Critical Impact

Authenticated attackers with administrator privileges can inject malicious JavaScript that executes whenever any user accesses an injected page, potentially leading to session hijacking, credential theft, or administrative account compromise on WordPress multi-site installations.

Affected Products

• Gotham Block Extra Light plugin for WordPress versions up to and including 1.5.0
• WordPress Multi-site installations
• WordPress installations where unfiltered_html has been disabled

Discovery Timeline

• 2026-01-14 - CVE CVE-2025-15021 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2025-15021

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability affects the Gotham Block Extra Light WordPress plugin through its admin settings functionality. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and requires administrator-level access to exploit.

The attack requires network access and high privileges, but once malicious scripts are injected, they persist in the database and execute in the context of any user who views the affected pages. This is particularly dangerous in multi-site WordPress environments where a compromised administrator on one site could potentially impact users across the network.

The vulnerability specifically affects installations where unfiltered_html capability has been disabled, which is a common security hardening measure. Ironically, this security configuration is required for the vulnerability to be exploitable, as sites with unfiltered_html enabled already allow administrators to inject arbitrary HTML content.

Root Cause

The root cause of this vulnerability lies in insufficient input sanitization and output escaping within the plugin's admin settings handlers. When administrator users save configuration options, the plugin fails to properly sanitize user-supplied input before storing it in the database. Additionally, when these stored values are rendered on the frontend, the plugin does not apply appropriate output escaping functions such as esc_html(), esc_attr(), or wp_kses().

The vulnerable code paths can be found in the plugin's gothamblock.php file, specifically around lines 463, 470, 495, 500, 504, 519, 564, and 578, as documented in the WordPress Plugin Code Review.

Attack Vector

The attack vector requires an authenticated user with administrator-level permissions to access the plugin's settings page within the WordPress admin dashboard. The attacker would inject malicious JavaScript payloads into configuration fields that lack proper sanitization.

Once the malicious payload is saved to the database, it becomes persistent. Any user—including other administrators, editors, or site visitors—who accesses a page where the injected content is rendered will have the malicious script executed in their browser context. This can lead to session cookie theft, keylogging, phishing overlays, or redirection to malicious sites.

The vulnerability mechanism involves unsanitized admin settings being stored directly to the WordPress options table and subsequently rendered without proper escaping. Detailed technical analysis is available in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-15021

Indicators of Compromise

• Unexpected JavaScript code or <script> tags in WordPress options related to Gotham Block Extra Light plugin settings
• Suspicious administrator activity in WordPress admin logs, particularly around plugin settings pages
• User reports of unexpected browser behavior or redirects when visiting site pages
• Anomalous network requests originating from user browsers to external domains

Detection Strategies

• Review WordPress database entries in the wp_options table for suspicious HTML or JavaScript content in Gotham Block Extra Light related options
• Implement Content Security Policy (CSP) headers to detect and prevent inline script execution
• Deploy Web Application Firewall (WAF) rules to monitor for XSS payload patterns in POST requests to admin settings endpoints
• Enable WordPress audit logging to track changes to plugin settings by administrator accounts

Monitoring Recommendations

• Configure SentinelOne to monitor WordPress admin directories for anomalous file modifications or suspicious activity patterns
• Set up alerts for unusual administrator login patterns or settings changes outside normal business hours
• Monitor outbound network connections from web servers for potential data exfiltration attempts
• Implement browser-based XSS detection mechanisms to identify script injection attempts in real-time

How to Mitigate CVE-2025-15021

Immediate Actions Required

• Update the Gotham Block Extra Light plugin to a patched version when available from the WordPress plugin repository
• Review and audit current plugin settings for any suspicious or unexpected content
• Temporarily disable the Gotham Block Extra Light plugin if an immediate update is not available
• Implement strict access controls to limit administrator accounts to only trusted personnel

Patch Information

At the time of publication, users should monitor the WordPress plugin repository for an updated version of Gotham Block Extra Light that addresses this vulnerability. The vulnerable versions include all releases up to and including 1.5.0. Organizations should subscribe to security advisories from Wordfence for notification when a patch becomes available.

Workarounds

• Disable the Gotham Block Extra Light plugin until a security patch is released
• Implement Web Application Firewall rules to filter potentially malicious input to admin settings endpoints
• Restrict administrator access to trusted users only and enforce strong authentication (MFA) for all admin accounts
• Enable unfiltered_html capability restriction via wp-config.php by adding define('DISALLOW_UNFILTERED_HTML', true); (note: this does not fix the vulnerability but is a general security hardening measure)

# WordPress security hardening in wp-config.php
# Add before "That's all, stop editing!" comment

# Restrict file editing from admin panel
define('DISALLOW_FILE_EDIT', true);

# Force SSL for admin access
define('FORCE_SSL_ADMIN', true);

# Limit post revisions to reduce database bloat
define('WP_POST_REVISIONS', 3);