This flaw allows stored cross‑site scripting due to improper neutralization of user input during web page generation. When malicious script is stored in an embed block, any visitor who loads that content will have the script executed in their browser context, enabling the attacker to steal session cookies, deface the page or inject further malicious code. The impact is primarily on confidentiality and integrity of site content. The CVE description does not indicate that privilege escalation is possible; this is not supported by the given information. Based on the description, it is inferred that attackers can persist malicious payloads in the embed block data until it is viewed by a user.

WordPress installations that use the CodePen Embed Block plugin by Chris Coyier, version 1.2.0 or earlier.

The CVSS score of 5.9 classifies this vulnerability as medium severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would probably achieve exploitation by inserting malicious code into an embed block, a task typically available to authenticated users with content‑creation capabilities.