CVE-2025-12180
The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.3. This is due to the plugin storing arbitrary CSS styles submitted via the qi-blocks/v1/update-styles REST API endpoint without proper sanitization in the update_global_styles_callback() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary CSS, which can be used to perform actions such as hiding content, overlaying fake UI elements, or exfiltrating sensitive information via CSS injection techniques.
No affected software listed.
- https://plugins.trac.wordpress.org/browser/qi-blocks/tags/1.4.3/inc/admin/global-styles/class-qi-blocks-framework-global-styles.php#L145
- https://plugins.trac.wordpress.org/changeset/3387712/qi-blocks/trunk/inc/admin/global-styles/class-qi-blocks-framework-global-styles.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/42e63318-661e-465d-919f-df0635ea1a6d?source=cve
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime