CVE-2025-64383
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Stored Cross-Site Scripting (XSS) vulnerability in Qi Blocks (versions up to 1.4.3). Allows an attacker to inject a persistent script that executes in the victim's browser.
Risk Assessment
Risk of session theft, account takeover, or unauthorized actions performed on behalf of the victim.
Recommendation
Update Qi Blocks to the latest available version that includes XSS fixes.
Other vulnerabilities in Qi Blocks
See all- CVE-2026-10096Medium
The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in versions up to and including 1.4.9. Missing validation on the 'page_id' parameter allows authenticated attackers with author-level access or higher to modify Qi Blocks styles of arbitrary posts, templates, or widgets they do not own, including site-wide surfaces via reserved 'template' and 'widget' values.
- CVE-2025-12180Medium
The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.4.3. The plugin stores arbitrary CSS styles submitted via the `qi-blocks/v1/update-styles` REST API endpoint without proper sanitization in the `update_global_styles_callback()` function. An authenticated attacker with Contributor-level access or higher can inject arbitrary CSS, which can be used to hide content, overlay fake UI elements, or exfiltrate sensitive information via CSS injection techniques.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks allows Stored XSS.This issue affects Qi Blocks: from n/a through <= 1.4.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS