CVE-2025-15021

Name of the Vulnerable Software and Affected Versions Gotham Block Extra Light versions prior to 1.5.1

Description The Gotham Block Extra Light plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled.

Recommendations Update Gotham Block Extra Light to version 1.5.1 or later.