The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject malicious JavaScript into pages generated by the Magical Blocks plugin. While the CVE description does not specify the exact consequences, such an injection could potentially enable cookie theft, session hijacking, or execution of arbitrary actions on the site visitor’s behalf (inferred).

The exploit affects WordPress installations that use the Magical Blocks plugin from its initial release up to and including version 1.0.12. The plugin is developed and distributed by Noor Alam under the name Magical Blocks.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is reported as less than 1 %, suggesting that exploitation has not been frequently observed. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector would involve gaining access to a content or block editor interface to inject malicious payloads into stored data, but this inference is not explicitly stated in the CVE.