The Useful Tab Block – Responsive & AMP-Compatible plugin allows authenticated users with Contributor level or higher to store malicious JavaScript in the ‘className’ field. Because input is not properly sanitized and output is not escaped, the injected script is saved to the post and runs in the browsers of any user who visits the page. This stored XSS can be used to hijack sessions, steal credentials, deface content, or execute arbitrary code in the context of the WordPress site.

The vulnerability affects the WordPress plugin "Useful Tab Block – Responsive & AMP-Compatible" by bbc000tommy, for all releases up to and including version 1.3.2. Sites running any WordPress installation with an active instance of this plugin should verify their installed version.

With a CVSS score of 6.4 the flaw is considered moderate, and an EPSS score of < 1% suggests the exploitation probability is low but not negligible. Because the attack requires Contributor or higher privileges, it is unlikely to be abused remotely by an unauthenticated attacker, but anyone with the needed role (such as a legitimate contributor or an attacker who has compromised a contributor account) can inject arbitrary script. The flaw is not listed in the CISA KEV catalog, but site administrators should treat it with caution given the potential impact of XSS.