Introduction

On 14 August 2025 a stored Cross-Site Scripting issue (CVE-2025-5844) affecting Radius Blocks (≤ 2.2.1) was disclosed. The vulnerability allows an authenticated user with Contributor privileges (or higher) to store HTML/JavaScript content in a plugin parameter named subHeadingTagName. When that stored value is rendered without proper sanitization or escaping, it can execute in a victim’s browser — impacting site visitors and privileged users who view the affected output.

Below is a concise technical explanation, detection and mitigation steps, developer guidance for a proper fix, and incident response recommendations. The tone is practical and oriented to site owners, developers, and security teams operating in fast-moving publishing environments.

Quick summary

• Vulnerability type: Stored Cross-Site Scripting (XSS)
• Affected software: Radius Blocks plugin, versions ≤ 2.2.1
• CVE: CVE-2025-5844
• Required attacker privilege: Contributor (authenticated)
• Exploitability: Moderate — requires a Contributor account but the payload persists and can execute for other users later
• Severity / CVSS: Reported CVSS 6.5 (medium-low) — meaningful impact, especially on multi-author or editorial sites
• Official fix: Not available at disclosure time — apply mitigations and limit privileges

Why stored XSS from a Contributor matters

Stored XSS is high impact because malicious input is persisted in the database, then executed when another user loads the page. Key considerations:

• Contributor accounts are common in editorial workflows in Hong Kong and elsewhere. Writers and volunteers often have these accounts.
• Contributors can create content or save block attributes. If block attributes are stored without validation, a Contributor can persist script-bearing payloads that later execute for Editors, Administrators, or visitors.
• Stored XSS can enable session theft, privilege escalation (via browser-initiated admin actions), content defacement, phishing redirection, or persistent malware delivery.

How this vulnerability works (technical overview)

The issue centers on a parameter called subHeadingTagName. It is intended to store an HTML tag name (for example, h2, h3). Correct handling requires strict validation against an allowlist of permitted tag names and proper escaping at output. In the vulnerable code path, input supplied by an authenticated Contributor is stored and later output without sanitization/escaping or validation, enabling script injection.

Typical problematic patterns that lead to this bug:

• Accepting arbitrary strings for a “tag name” and storing them directly.
• Rendering user input into HTML with little or no escaping (e.g., echoing a value into a tag name or attribute context).
• Missing capability or nonce checks on REST/AJAX endpoints used to save block attributes.

What an attacker with Contributor access could do

• Submit a crafted value for subHeadingTagName that contains a script or on* attribute, relying on output that will not be sanitized.
• Because the value is stored, the payload will affect every visitor who loads that content — including Editors and Administrators who open it in the block editor or settings panel.
• Embed client-side code that performs redirection, steals cookies or session tokens (if HttpOnly flags are missing), or triggers browser-initiated requests that perform privileged actions on behalf of an authenticated admin.

Important contextual notes

• This is not an unauthenticated RCE or SQL injection: an attacker needs a logged-in account with Contributor privileges or higher.
• The impact depends on how the plugin uses the subHeadingTagName value: if it is rendered on the front-end to visitors or in the admin area to editors, the attack surface is larger.
• Secure cookie flags (HttpOnly, SameSite) and CSP headers may reduce some risks, but they are not a substitute for server-side validation and escaping.

Immediate risk reduction for site owners

If you run WordPress and have Radius Blocks installed, consider the following immediate actions.

1. Limit Contributor access temporarily

• Restrict who has Contributor accounts. Disable or remove unused Contributor accounts.
• If your workflow allows, temporarily downgrade or lock Contributor accounts until the site is patched or mitigated.

2. Audit recent content and settings

• Search for suspicious content in posts, postmeta, widget options, and plugin options where block attributes may be stored. Look for strings containing , javascript:, onerror=, onload=, or unusual HTML inserted into tag settings.
• Use WP-CLI or direct database queries to find suspicious entries (examples below in the detection section).

%3$s',
    esc_html( $tag ),
    esc_attr( $class ),
    esc_html( $content )
);
?>

 array( 'href' => true, 'title' => true ),
    'strong' => array(), 'em' => array(),
    // ... limited tags only
);
$safe_html = wp_kses( $input_html, $allowed_html );
?>

wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%

' . esc_html( $content ) . '';
?>