CVE-2025-15678 is a stored Cross-Site Scripting (XSS) vulnerability in the Nexter Blocks WordPress plugin. The flaw arises because the plugin does not sanitize uploaded SVG files, allowing users with upload privileges to embed malicious JavaScript. When these SVG files are accessed, the embedded script executes, potentially compromising the confidentiality and integrity of affected sites. The vulnerability affects versions prior to 5.0.2, though no explicit affected versions or patch information is provided in the source data.

Successful exploitation can lead to stored XSS attacks, allowing attackers to execute arbitrary JavaScript in the context of the affected site. This can result in information disclosure and integrity impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). The attack requires user interaction and network access but no privileges beyond file upload rights (Author role by default). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability involves improper sanitization of SVG uploads, restricting SVG uploads to trusted users or disabling SVG uploads until a fix is available may reduce risk. Monitor official Nexter Blocks plugin updates for a security patch addressing this issue.