CVE-2025-8607: SlingBlocks Gutenberg Plugin XSS Vulnerability

CVE-2025-8607 Overview

CVE-2025-8607 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the SlingBlocks – Gutenberg Blocks by FunnelKit plugin for WordPress. The flaw affects all versions up to and including 1.6.0. It resides in the Countdown block's attribute handling, where user-supplied input is neither properly sanitized nor escaped on output. Authenticated users with Contributor-level permissions or higher can inject arbitrary JavaScript into pages. The payload executes in the browser of any visitor who views the affected page.

Critical Impact

Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft and administrative action abuse.

Affected Products

• SlingBlocks – Gutenberg Blocks by FunnelKit (formerly WooFunnels) WordPress plugin
• All plugin versions up to and including 1.6.0
• WordPress sites allowing Contributor-level or higher accounts

Discovery Timeline

• 2025-08-21 - CVE-2025-8607 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8607

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the SlingBlocks Countdown Gutenberg block. The plugin accepts attributes supplied through the block editor and later renders them into page HTML. The rendering path fails to apply adequate sanitization on input and does not escape output. An authenticated Contributor can craft block attributes containing JavaScript payloads. Once an editor publishes the content, or a visitor previews the draft, the browser executes the attacker-controlled script in the site's origin.

Stored XSS in a WordPress plugin provides a path from a low-privileged content role to effective administrator compromise. Scripts running in an administrator's browser can create new users, modify plugin settings, or exfiltrate session cookies and nonces.

Root Cause

The root cause is insufficient input sanitization and missing output escaping on Countdown block attributes. WordPress block attributes should be filtered through functions such as sanitize_text_field() on save and esc_attr() or esc_html() on render. The vulnerable code paths in slingblocks/trunk omitted these controls, allowing raw markup to persist in post content.

Attack Vector

Exploitation requires an authenticated account with Contributor privileges or higher. The attacker inserts a Countdown block, injects a JavaScript payload into one of the block's attributes, and submits the post for review or publication. When another user, including an administrator, loads the rendered page, the script executes in their session context. No user interaction beyond normal page navigation is required.

For technical remediation details, see the WordPress Changeset 3347030 and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-8607

Indicators of Compromise

• Post or page content containing Countdown block attributes with <script>, javascript:, or inline event handlers such as onerror= and onload=.
• Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing posts authored by Contributor accounts.
• New administrator accounts or plugin installations with no corresponding admin-initiated action in the WordPress audit log.

Detection Strategies

• Scan the wp_posts table for Countdown block markup containing script tags or JavaScript URI schemes in attribute values.
• Review recent post revisions submitted by Contributor-level accounts for suspicious block attributes.
• Enable Content Security Policy (CSP) reporting to surface inline script execution attempts that violate policy.

Monitoring Recommendations

• Alert on creation or modification of WordPress users with elevated roles outside of change windows.
• Monitor administrator session cookies for use from unexpected IP addresses or user agents.
• Log and review all plugin and theme file modifications made through the WordPress admin interface.

How to Mitigate CVE-2025-8607

Immediate Actions Required

• Update the SlingBlocks – Gutenberg Blocks by FunnelKit plugin to a version later than 1.6.0 that contains the fix from WordPress changeset 3347030.
• Audit all existing posts containing Countdown blocks and remove any attribute values containing script content.
• Review recent activity for Contributor and Author accounts and rotate credentials for any suspicious users.

Patch Information

The vendor addressed the vulnerability in the commit tracked by WordPress Changeset 3347030. The patch adds input sanitization and output escaping to the Countdown block's attribute handling. Site administrators should update through the WordPress plugin manager to receive the fix.

Workarounds

• Restrict Contributor and Author role assignment to trusted users only until the patch is applied.
• Deactivate the SlingBlocks plugin on sites that do not use the Countdown block pending the update.
• Deploy a Web Application Firewall (WAF) rule that blocks block-editor requests containing script tags or JavaScript URI schemes in post content.