The SB Chart block plugin contains a stored XSS vulnerability that arises from insufficient input sanitization of the className parameter. When an authenticated user with Contributor privileges or higher injects malicious JavaScript via this field, the payload is saved in the database and executed each time anyone views the affected page. Attackers can hijack user sessions, deface content, or steal sensitive information, and the flaw persists until the data is removed or the plugin is updated.

The vulnerability affects the SB Chart block plugin from bobbingwide, specifically all releases up to and including version 1.2.6. Users running any of these versions are at risk, while newer releases beyond 1.2.6 are not impacted.

With a CVSS score of 6.4 the flaw is considered moderate, and the EPSS score of < 1% indicates a low probability of exploitation in the wild. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires the plugin to be installed and an attacker to have at least Contributor access; the attack path involves submitting a block with a crafted className value, which is then stored and rendered for all visitors. Due to the authenticated requirement, the risk is contained to sites with exposed Contributor accounts, but the impact on the site's user base can still be significant.