The Osom Blocks – Custom Post Type listing block plugin for WordPress contains a Stored Cross-site Scripting vulnerability that originates from insufficient input sanitization and output escaping of the class_name field. As a result, an authenticated user with Contributor privileges or higher can inject arbitrary JavaScript into block listings, with the payload persisting in the database and executing whenever a victim visits a page that renders the injected block. These client‑side scripts can be used to steal session cookies, deface content, or otherwise perform malicious actions on behalf of the victim user.

All publicly released versions of the Osom Blocks plugin for WordPress from the vendor osompress, including version 1.2.1 and earlier, are affected. Any WordPress site that installs the plugin and has contributors or higher roles is potentially vulnerable, regardless of which theme or other plugins are in use. No information is available indicating that later releases contain a fix, so site owners should check the plugin’s update channel or vendor announcements for an approved patch.

The vulnerability has a CVSS score of 6.4, placing it in the moderate severity range, and an EPSS score of less than 1%, suggesting a relatively low likelihood of exploitation in the wild at the time of analysis. It is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with Contributor or higher privilege; the attacker must create or edit a block with a crafted class_name value that is rendered without proper escaping. Successful exploitation would lead to arbitrary script execution in the victim’s browser, enabling theft of credentials, defacement, or further compromise of the site.