The Progress Bar Blocks for Gutenberg plugin is affected by a stored Cross-Site Scripting vulnerability that can be exploited when an SVG file is uploaded. Authenticated users with Author-level access or higher can embed malicious scripts that will execute in the browsers of any user who views the SVG file, potentially compromising user sessions and accessing sensitive data. The flaw stems from insufficient input sanitization and improper output escaping when handling SVG uploads, allowing arbitrary script injection.

The vulnerability impacts the WordPress plugin Progress Bar Blocks for Gutenberg from vendor jobayer534. All releases up through and including version 1.0.0 are affected; no later versions are disclosed as vulnerable.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1 % shows a low probability of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting it is not a known widely exploited issue. Attackers must hold at least Author‑level privileges within a WordPress site to upload the malicious SVG; exploitation is local to the authenticated user base and requires the plugin to be active. Proper mitigation is recommended to avoid the risk of arbitrary script execution on the site.