The vulnerability originates from insufficient input sanitization of the alpha_block_css parameter in the Alpha Blocks WordPress plugin. Because the plugin outputs the value without proper escaping, an attacker can store malicious JavaScript that will run in the browser context of any user who views the affected page. This is a classic stored XSS flaw (CWE‑79). The impact is that the attacker can steal credentials, session cookies or perform other client‑side attacks against users of the WordPress site.

Vulnerable versions are all releases of Alpha Blocks up to and including 1.5.0, a plugin distributed by robiulawal40. The flaw can affect any WordPress installation that has the plugin installed and accepts contributor or higher privileged users.

The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score of less than 1 % shows that the likelihood of public exploitation is currently low, and the flaw is not listed in the CISA KEV catalog. However, exploitation requires authenticated access with Contributor‑level permissions, making it accessible to users who can create or edit blocks. If such accounts exist, an attacker can inject code that will be executed whenever another site visitor loads a block containing the stored CSS. The attack vector is therefore origin‑controlled input from a logged‑in user.