The vulnerability is a stored cross‑site scripting flaw caused by improper input sanitisation in the Arkhe Blocks plugin. The flaw allows an attacker to inject malicious script content that is persisted in the database and subsequently executed in the browsers of any user who visits affected pages. Based on the description, it is inferred that an attacker with permission to submit content could inject the malicious script, which may lead to theft of session cookies, defacement, or fraudulent actions.

The flaw is present in all releases of the Ryo Arkhe Blocks WordPress plugin up to and including version 2.27.1. Site operators running WordPress installations that use this plugin version are at risk, regardless of other security settings.

The CVSS score of 6.5 indicates medium severity, consistent with a stored XSS that can compromise confidentiality and integrity of user sessions. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalogue. Based on the description, it is inferred that the attack path typically involves submitting malicious payloads via a content entry point, and no elevated privileges or remote code execution are required.