The vulnerability in the CyberChimps Responsive Blocks plugin arises from the plugin failing to neutralize user input before rendering it on web pages, resulting in a reflected Cross‑Site Scripting flaw (CWE‑79). Because the plugin reflects unsanitized input into the page output, an attacker could cause arbitrary script execution in the browsers of site visitors who view the affected page, potentially leading to client‑side compromise.

All versions of the WordPress Responsive Blocks plugin through 1.9.9 distributed by CyberChimps are affected. Any installations of these versions that are hosting a WordPress site are vulnerable.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1 % suggests a low likelihood of exploitation in the population, and the issue is not listed in CISA’s KEV catalog. The flaw can be triggered remotely by supplying maliciously crafted input that the plugin renders without sanitization. No public exploits have been reported, but the moderate score and low EPSS still warrant timely mitigation.