The vulnerability is a failure to neutralize user input during rendering in the PublishPress Gutenberg Blocks plugin, which allows stored cross‑site scripting for all releases up to version 3.3.1. This flaw permits an attacker to embed malicious JavaScript that will be executed in the browsers of any visitor who views a Gutenberg block that contains the injected payload.

WordPress sites that have the PublishPress Gutenberg Blocks plugin installed at versions 3.3.1 or earlier are at risk. The CVE entry does not specify a fixed version, but any release after 3.3.1 is expected to contain a fix.

Based on the description, the likely attack vector is web‑based: an attacker with sufficient editorial permissions could create or update a Gutenberg block that includes malicious script, which will then execute in the browsers of all site visitors. The CVSS base score of 6.5 indicates moderate severity, and the EPSS score of less than 1% signals a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog.