The Gotham Block Extra Light plug‑in for WordPress suffers from stored Cross‑Site Scripting because it fails to sanitize and escape data entered into its administrative settings. Any script stored via the admin panel will be rendered unescaped in pages that display the plugin’s output. An attacker who has administrator or higher privileges can thus inject malicious JavaScript that runs in the browser of any user who views an affected page. This vulnerability allows for session hijacking, credential theft, or defacement of site content.

All versions of Gotham Block Extra Light 1.5.0 or earlier on WordPress sites are affected, with the issue present only on multi‑site installations or installations where the unfiltered_html capability has been removed. The stack includes the Gotham Block Extra Light plugin by gothamdev and any WordPress installation that has not disabled the unfiltered_html filter.

The CVSS score of 4.4 indicates moderate severity, and the EPSS score of less than 1 % suggests the risk of exploitation is low at the moment. The vulnerability is not listed in the CISA KEV catalog. Attackers need legitimate administrator access to the WordPress network to inject the payload, so the attack vector is authenticated privilege escalation via the plugin’s settings interface.