The A/B Testing for WordPress plugin contains a stored XSS flaw triggered by the "id" parameter of the "ab-test-block" block. Input is not properly sanitized or escaped, so an attacker can embed JavaScript code. When a page that includes that block is rendered, the injected script runs in the context of the visiting user, enabling cookie theft, phishing, or other malicious actions.

The vulnerability affects all releases of the A/B Testing for WordPress plugin by johnjamesjacoby up to and including version 1.18.2. WordPress sites that have installed this plugin and granted contributor‑level or higher accounts are potentially impacted.

The CVSS score of 6.4 rates the flaw as moderately severe, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The attack requires an authenticated account with contributor privileges. Since the exploit involves only data entry into the plugin’s block editor, it does not require controlling other users or servers. The flaw is not listed in CISA KEV, so it is not known to be actively exploited in the wild yet.