A stored XSS flaw in the bPlugins Timeline Block plugin allows an attacker to embed malicious JavaScript that is rendered to all visitors of the affected site. The injection occurs when content is entered into the plugin’s input fields and is not properly neutralized, leading to a Classic CWE-79 weakness. Exploiting this vulnerability can compromise user sessions, deface content, or redirect browsers to malicious sites, thereby threatening confidentiality, integrity, and potentially availability of the web application.

The affected vendor is bPlugins and the product is the Timeline Block plugin. Every release up to and including 1.1.1 is vulnerable; no later release is listed as safe in the provided data and therefore all versions ≤ 1.1.1 must be considered at risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of automated exploitation. The vulnerability is not currently in the CISA KEV catalog. Attackers likely need access to the site’s administrative interface to inject payloads, which then execute in the browsers of all visitors to pages that display the stored content. Though no public exploit has been reported, the potential for cross‑domain data theft or session hijacking makes this a tangible risk for affected sites.