The vulnerability in the Qi Blocks WordPress plugin arises from a missing authorization check on the update-styles REST endpoint. Users with Contributor-level access can submit arbitrary CSS, which the plugin stores without sanitization. The injected CSS can hide or replace page elements, create deceptive UI overlays, or extract user data through CSS-based exfiltration techniques, thereby compromising the integrity and appearance of the site.

The Qi Blocks plugin by qodeinteractive, versions up to and including 1.4.3, is affected. WordPress sites that have installed this plugin and have Contributor or higher roles are susceptible.

The CVSS score of 4.3 indicates a low severity vulnerability, and the EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis. Because the flaw requires authenticated access, exploitation depends on the existence of Contributor or higher accounts. The vulnerability is not listed in CISA’s KEV catalog, but the potential for UI deception and data leakage warrants prompt remediation.