A flaw in the Stackable plugin allows sensitive information to be embedded within data that is subsequently sent out, such as through the block editor or content submission. The vulnerability can expose confidential content that should otherwise remain hidden in the editor or backend, thereby compromising the confidentiality of the site’s data. The weakness aligns with CWE‑201, indicating an unintended disclosure of private information.

WordPress sites that have installed Benjamin Intal’s Stackable plugin, versions up through 3.18.1, are vulnerable. Sites using any older version or a different plugin are not affected.

The CVSS score of 4.3 reflects a moderate risk due primarily to data exposure rather than direct code execution. The EPSS score of less than 1% suggests a very low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the plugin’s editing interface, where a user with sufficient privileges or a malicious payload could embed or retrieve sensitive data. Because no active exploit is known, the overall risk is moderate but a data breach could have serious consequences for affected sites.