The Ultimate Blocks plugin contains a stored cross‑site scripting flaw that arises from the 'buttonTextColor' field not being properly sanitized or escaped. When a contributor or higher user supplies a malicious value, the script is stored in the block definition and will be executed each time the block is rendered. This allows the attacker to run arbitrary code in the browser context of any visitor to the affected page, potentially hijacking user sessions or exfiltrating data.

Affected sites are those running the Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor plugin, versions 3.2.7 and earlier. The vulnerability exists in all block types that expose the 'buttonTextColor' parameter. Sites that have not upgraded beyond 3.2.7 remain vulnerable.

The flaw carries a CVSS score of 6.4, indicating a medium‑to‑high impact if exploited, but the EPSS score of less than 1% shows the likelihood of exploitation is very low. The issue is not listed in the CISA KEV catalog. Attackers need only contributor permissions or higher to inject the payload, so the attack vector is authenticated web interface. While the risk is moderate, the potential damage to confidentiality, integrity and availability of users' browsers warrants prompt action.