The BlockArt Blocks plugin is vulnerable to stored XSS because the ‘timestamp’ attribute is not properly sanitized or escaped. When a contributor or higher level user submits a payload via this field, it is written to the database and later rendered unchanged on any page that includes the block. An attacker can thus inject arbitrary JavaScript that executes in the browsers of all visitors who view the affected page, potentially allowing session hijacking, credential theft, defacement, or further malicious activity.

All users of the BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks, WordPress Block Plugin, Sections & Template Library plugin for WordPress with versions 2.2.13 or earlier are affected. No more recent versions are listed as vulnerable; the issue exists in every release up to and including 2.2.13.

With a CVSS score of 6.4 the vulnerability is considered moderate. The EPSS score is below 1 %, indicating a very low likelihood of exploitation. It is not included in the CISA KEV catalog. Exploitation requires a valid contributor‑level or higher account to inject the payload, and the injected code will run whenever any user loads the affected page. Based on the data, these conditions make the vulnerability modestly serious but unlikely to be actively exploited in the near term.