The vulnerability arises from improper neutralization of input during page rendering in WP Engine’s Gutenberg Blocks – ACF Blocks Suite plugin, allowing a stored cross‑site scripting flaw that can execute malicious scripts when a page containing the block is viewed by any user.

WP Engine’s Gutenberg Blocks – ACF Blocks Suite plugin versions up to and including 2.6.11 are affected; any WordPress site deploying this plugin before upgrading to 2.6.12 or later is at risk regardless of the host environment.

With a CVSS score of 6.5, the vulnerability has moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The issue is not listed in the CISA KEV catalog, suggesting no widespread active exploitation. Based on the description, it is inferred that an attacker would need the ability to submit or modify block content—typically requiring author or administrator privileges—to inject malicious code. Once executed, the injected script would operate in the context of any visitor to the affected page, potentially compromising confidentiality, integrity, or availability.