The vulnerability is an improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that are stored in the database and executed in subsequent page loads. This stored XSS can compromise the confidentiality and integrity of user data, facilitate session hijacking, and enable phishing or defacement attacks. The weakness is a classic input validation flaw identified as CWE‑79. The description confirms the issue exists in all versions up to and including 2.0.0 of the plugin.

The affected component is the WordPress B Blocks plugin released by bPlugins, specifically versions up to and including 2.0.0. Any WordPress site that has installed or has ever upgraded to one of these vulnerable releases is potentially impacted.

The CVSS v3 score of 6.5 indicates moderate severity, but the execution likely requires an authenticated user with permission to add or edit content in the B Blocks interface, as the malicious code is stored by the plugin when content is entered. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, an attacker who is able to submit content through the plugin’s interface can persist scripts that will later execute in the browsers of any user who views the affected page, including administrators. The security community typically recommends that such stored XSS risks be treated with high caution because they can affect many users across multiple sites.