The Game Review Block plugin for WordPress is vulnerable to stored cross‑site scripting through the className parameter in all versions up to 4.8.1. Insufficient input sanitization and output escaping allow an attacker who has at least Contributor level access to inject arbitrary web scripts that will execute whenever another user views the injected page. This flaw can be used to deface content, steal user credentials, or perform other malicious actions within the site’s authenticated context.

Marcdk’s Game Review Block plugin for WordPress, versions 4.8.1 and earlier, is affected. Any installation of these versions must be verified and updated.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1% suggests exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires a user with Contributor or higher privileges to inject the payload; from that point the scripts run with the privileges of the affected site visitor. The lack of broader access permissions limits the scope to authenticated users who view compromised pages.