The Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress contains a stored cross‑site scripting flaw in the titleTag parameter. The plugin fails to properly sanitize or escape the value supplied by users with Contributor or higher privileges, enabling them to inject arbitrary JavaScript that executes whenever a page containing the injected block is loaded. Once injected, the script runs in the browser context of every visitor to that page, potentially leading to session hijacking, credential theft, phishing, or site defacement.

Any WordPress installation that uses the Rise Blocks – A Complete Gutenberg Page Builder plugin of version 3.6 or earlier is affected. The vulnerability applies to all releases through 3.6 as identified by the vendor and confirmed by source code references. No specific sub‑release information is available beyond that the flaw exists up to and including 3.6.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw requires an authenticated user with at least Contributor role, meaning the attacker must first compromise valid credentials or abuse an existing account with sufficient privileges. Because the vulnerability is stored, a single injection can affect all site visitors until the content is cleaned or the plugin is updated. The flaw is not listed in the CISA KEV catalog, so it has not been observed in large‑scale exploitation campaigns as of now.