The Interactions – Create Interactive Experiences in the Block Editor plugin is vulnerable to stored XSS. Insufficient sanitization of event selector inputs and missing output escaping enable an authenticated contributor or higher to embed arbitrary JavaScript that will run automatically whenever a page containing the edited event selector is loaded by any visitor. This can lead to session hijacking, credential theft, or arbitrary code execution in the context of the site’s user accounts.

The vulnerability exists in the WordPress plugin Interactions – Create Interactive Experiences in the Block Editor from the vendor bfintal. All releases up to and including version 1.3.1 are affected. Site administrators should check the plugin version and upgrade if necessary.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is below 1 %, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires an attacker to have Contributor‑level or higher access to the WordPress installation, a condition that is likely satisfied in many collaborative sites. Once an event selector is injected, the malicious script runs for every visitor without further action, making this a persistent threat to all users who view the compromised page.