CVE-2025-26937: bPlugins Icon List Block Stored XSS Flaw

CVE-2025-26937 Overview

CVE-2025-26937 is a stored Cross-Site Scripting (XSS) vulnerability in the bPlugins Icon List Block plugin for WordPress. The flaw affects all versions through 1.1.3 and stems from improper neutralization of input during web page generation [CWE-79]. Authenticated users with low privileges can inject malicious scripts that persist in page content and execute in the browser context of any visitor who loads the affected page. The vulnerability requires user interaction and operates with a scope change, meaning injected scripts can affect resources beyond the vulnerable component.

Critical Impact
Attackers with contributor-level access or higher can store malicious JavaScript in Icon List Block content, leading to session hijacking, administrative account takeover, and redirection of site visitors.

Affected Products

bPlugins Icon List Block (icon-list-block) WordPress plugin
All versions up to and including 1.1.3
WordPress sites with the plugin installed and enabled

Discovery Timeline

2025-02-25 - CVE-2025-26937 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26937

Vulnerability Analysis

The Icon List Block plugin fails to sanitize and escape user-supplied input before rendering it as part of block content on WordPress pages. When a contributor or editor configures an icon list, attacker-controlled attributes are stored in the post content and later rendered without proper encoding. This allows arbitrary HTML and JavaScript to execute in the context of the WordPress site.

Stored XSS vulnerabilities in Gutenberg blocks are particularly impactful because the payload persists in the database and executes for every visitor who loads the affected content. The scope change indicates that injected scripts can escape the block's rendering context and interact with the broader page, including administrative interfaces when a privileged user previews or edits the content.

Root Cause

The root cause is missing or insufficient output escaping in the block's render callback. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses_post() for safely rendering user content, but the plugin either omits these calls or applies them incorrectly to block attributes. Input validation at the save stage is also insufficient to prevent script payloads from being stored.

Attack Vector

Exploitation requires an authenticated user with permission to create or edit posts, typically a contributor or higher. The attacker inserts an Icon List Block and crafts attributes containing JavaScript payloads, often through event handlers or embedded <script> tags within text, URL, or icon configuration fields. Once the post is saved and viewed, the stored payload executes in the visitor's browser. If an administrator views the content, the attacker can perform actions with administrative privileges, including plugin installation and user creation.

Technical details are available in the Patchstack advisory.

Detection Methods for CVE-2025-26937

Indicators of Compromise

Post content containing Icon List Block markup with inline event handlers such as onerror, onload, or onclick
Unexpected <script> tags, javascript: URIs, or encoded payloads stored within wp_posts entries
Creation of new administrator accounts or installation of unknown plugins shortly after a contributor submitted content
Outbound HTTP requests from administrator browser sessions to unfamiliar domains

Detection Strategies

Audit the wp_posts table for Icon List Block shortcodes or block comments containing suspicious attribute values
Review WordPress activity logs for low-privilege users submitting or editing posts that contain Icon List blocks
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages using the plugin
Scan rendered page output for script payloads that do not originate from legitimate theme or plugin assets

Monitoring Recommendations

Enable WordPress audit logging to track post creation, modification, and user role changes
Deploy a web application firewall (WAF) with rules that identify XSS payloads in block editor requests
Alert on administrative account creation and privilege changes outside of change windows
Track outbound network connections from browsers accessing the WordPress admin interface

How to Mitigate CVE-2025-26937

Immediate Actions Required

Identify all WordPress sites running the Icon List Block plugin at version 1.1.3 or earlier
Disable the plugin until a patched version is confirmed installed, if feasible
Review all existing posts and pages containing Icon List blocks for malicious payloads
Restrict contributor and author account creation and audit existing low-privilege accounts

Patch Information

At the time of publication, no fixed version is referenced in the available advisory. Monitor the Patchstack advisory and the plugin repository for an update beyond version 1.1.3. Apply the patched release across all affected environments as soon as it becomes available.

Workarounds

Deactivate and remove the Icon List Block plugin until a patched version is released
Apply a WAF rule to block XSS payloads targeting Icon List Block attributes
Enforce a strict Content Security Policy that disallows inline scripts on rendered pages
Limit post editing privileges to trusted users and require review before publishing contributor content

bash

# Example WP-CLI commands to inventory and deactivate the vulnerable plugin
wp plugin list --name=icon-list-block --fields=name,status,version
wp plugin deactivate icon-list-block