The Ultimate Blocks plugin for WordPress contains a stored cross-site scripting flaw that allows an authenticated user with Contributor role or higher to inject arbitrary JavaScript through the content parameter. Once injected, the script runs whenever a user visits the affected page, letting the attacker steal session cookies, deface content, or perform other malicious actions. The flaw is classified as CWE-79 and would compromise confidentiality, integrity and availability of the website if exploited.

The vulnerability affects the Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor plugin for WordPress. All releases up to and including version 3.2.7 are impacted. Users on older or later versions are not affected unless they have not upgraded.

With a CVSS score of 6.4 the flaw is of moderate severity. The EPSS score is less than 1%, indicating a low likelihood that existing attack tools will target this weakness. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated access, an attacker must first obtain a Contributor level or higher user account. Once the exploit is triggered, every visitor to the stored content will run the injected script, making the threat level high for sites with untrusted contributors.