The vulnerability in the bPlugins Button Block plugin allows an attacker to inject malicious scripts that are stored and later rendered in the web page. If an attacker can create or edit a button block, the unsafe input is not properly neutralized, enabling them to execute arbitrary JavaScript in the context of authenticated users who view the affected page. This can lead to theft of session data, hijacking of user accounts, defacement of the site, or redirection to malicious destinations. The weakness is a classic stored XSS flaw, as identified by CWE‑79.

All WordPress sites that have the bPlugins Button Block plugin installed in versions up to 1.1.9 are affected. The issue specifically targets the Button Block plugin without specifying a minimum WordPress core version, so any site using those releases is at risk.

The CVSS base score of 6.5 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation, which is not reflected in the CISA KEV catalog. The likely attack vector is via the WordPress admin interface where an attacker who can add or edit blocks can supply malicious payloads that are stored and later rendered to other visitors. Because the data is persisted, the impact persists until the content is removed or the plugin is upgraded. The weakness does not require network isolation or privileged server access, indicating that a compromised administrator account is sufficient for exploitation.