Improper neutralization of input during web page generation leads to a stored Cross‑Site Scripting flaw. The aBlocks plugin fails to sanitize user supplied data before rendering it, enabling an attacker to inject executable script that can execute in a site visitor’s browser. This can result in session hijacking, cookie theft, defacement, or the distribution of malware. The weakness is classified as CWE‑79, indicating a lack of proper output encoding or input validation.

WordPress sites that have the Kodezen LLC aBlocks plugin installed with version 1.9.2 or earlier are affected. The vulnerability applies to all releases in the range from the earliest available version through 1.9.2 inclusive.

The CVSS score of 6.5 describes a moderate severity issue. The EPSS score indicates a very low exploitation probability (<1%), and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via the plugin’s input fields that store arbitrary data; a malicious actor could inject code if they have the ability to create or submit content that is later rendered to other users. If the plugin is publicly exposed or admin privileges are widely distributed, the risk of exploitation increases. No active exploitation reports are known.