An authenticated user with Contributor privileges can place a malicious value in the subHeadingTagName field of any block. Because the plugin does not sanitize or escape that value before storing it in the database, the text is rendered unchanged when the page is viewed. The stored script runs in the browser context of any user who opens the affected page, allowing theft of credentials, session hijacking, or delivery of malware. The weakness is a classic CWE‑79 unsanitized input problem, providing an injection attack surface that achieves both confidentiality and integrity compromise.

The flaw exists in the Radius Blocks – WordPress Gutenberg Blocks plugin developed by techlabpro1, affecting all releases up through and including version 2.2.1. Sites that have installed this version and have users with Contributor or higher access are exposed.

The CVSS base score of 6.4 indicates moderate risk, while the EPSS score of less than 1% suggests a very low probability of being exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need authentication and the ability to edit block settings; after injection, the malicious code propagates to every visitor who loads the page, which makes addressing the issue a high priority for owners of vulnerable WordPress sites.