Improper neutralization of input during web page generation allows an attacker to store arbitrary JavaScript or HTML in the Ultimate Blocks plugin content. When other users view the affected page, the injected scripts execute in their browsers, potentially leading to session hijacking, defacement, or credential theft.

The vulnerability exists in the Ultimate Blocks plugin for WordPress, versions up to and including 3.3.6. Any WordPress site that installs this plugin and uses it to create or display content is potentially exposed.

The CVSS score of 6.5 indicates a medium severity rating. The EPSS score of less than 1 % and absence from the CISA KEV catalogue suggest a low likelihood of widespread exploitation. Based on the description, the vulnerability appears to be exploitable by an attacker who can insert content via the plugin’s block editor; the malicious payload is then stored and rendered for all visitors who view the affected page. This inference is derived from the stored‑XSS nature of the flaw, though the public data does not specify required authentication or specific privileges.