PatchSiren

Nexter Blocks CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Nexter Blocks CVE published 2026-08-06

CVE-2025-15678

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files (Author by default), allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site Scripting. This vulnerability has significant implications for users with author-level access or higher, as it c [truncated]