The vulnerability in the Responsive Blocks plugin allows stored cross‑site scripting due to improper input neutralization. An attacker who can inject content into the plugin’s input fields can store malicious scripts that execute in the browsers of all visitors who view the affected content. This can lead to session hijacking, defacement, or distribution of malware, compromising confidentiality, integrity, and availability of the site.

This flaw affects the WordPress Responsive Blocks plugin from the initial release through version 2.0.2 inclusive. The plugin is developed by CyberChimps and is installed on WordPress sites that use it.

The CVSS score of 6.5 indicates a moderate severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the short term. The vulnerability is not listed in the CISA KEV catalog, meaning there are no known active exploits. However, the stored XSS could be leveraged by an authenticated content editor or anyone with the ability to submit plugin content, making it reasonable for attackers to test for and exploit the flaw if they can reach the editing interface.