This vulnerability is an improper neutralization of input during web page generation, allowing a stored cross‑site scripting flaw in the WordPress Blockspare plugin. When an attacker can embed malicious script code into a Blockspare block, the script will run in the browsers of any site visitor or administrator who views the block, potentially compromising the security of the site.

All installations of the Blockspare WordPress plugin from its first release through version 3.2.9 are vulnerable, regardless of site configuration.

The CVSS score of 6.5 places this vulnerability in the medium severity range. The EPSS score of less than 1% indicates a very low likelihood of exploitation at this time, and it is not listed in CISA’s KEV catalog. Based on the nature of stored XSS, it is inferred that the attacker must be able to insert or modify a Blockspare block, which typically requires edit or administrator privileges. If such access is granted, the attacker can store malicious scripts that will execute whenever the block is rendered.