The BlockArt Blocks WordPress plugin, in all versions up to and including 2.2.14, contains a stored cross‑site scripting flaw. Insufficient input sanitization and output escaping in the BlockArt Counter component allows an authenticated user with contributor‑level access or higher to inject arbitrary JavaScript into page attributes. When a user opens a page containing the injected script, the code runs in that user’s browser, enabling theft of session cookies, defacement, or further attacks against other site visitors.

All WordPress sites that have the BlockArt Blocks plugin version 2.2.14 or earlier installed are affected. Site administrators should examine plugin versions through the WordPress plugin management interface to identify vulnerable installations.

The CVSS score of 6.4 indicates a moderate risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Attackers must be authenticated with contributor or higher privileges to craft the malicious block content, typically via the Gutenberg editor or block insertion interface. Once the malicious script is stored, it executes automatically for any visitor who loads the affected page, leading to potential data theft or session hijacking.