The vulnerability is a stored XSS flaw located in multiple widgets of the Ultimate Blocks – WordPress Blocks Plugin. Unescaped user input allows an authenticated Contributor or higher to inject arbitrary JavaScript that will run in the browsers of any visitor who views the affected page. Because the script is stored, the impact can persist across sessions and affect every user who accesses the page, potentially enabling session hijacking, credential theft, or site defacement.

WordPress sites using the Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor plugin version 3.3.3 or earlier. The plugin is authored by Ultimate Blocks (dotcamp). Any installation of the plugin that includes the vulnerable widgets is at risk when that plugin is older than 3.4.

The CVSS score of 6.4 indicates a medium severity. The EPSS score of <1% shows the probability of exploitation is very low at present, and the vulnerability is not listed in CISA's KEV catalog. Attackers must be authenticated and have Contributor or higher privileges to inject the payload, so the risk is limited to sites with exposed editor capabilities or insufficient role restrictions. Exploitation requires administrative access to the WordPress dashboard and the ability to edit or add content via the affected widgets.