Improper neutralization of input during web page generation in the landwire Responsive Block Control plugin results in a DOM-based XSS vulnerability. An attacker can inject malicious client‑side scripts that execute within the victim's browser, potentially leading to cookie theft, session hijacking, or defacement of the site. This may undermine both users’ confidentiality and the integrity of the site content.

The vulnerability affects the landwire Responsive Block Control plugin, all releases from the initial version through 1.3.0 inclusive. Sites using any version of the plugin older than 1.3.1 are potentially impacted.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests that the likelihood of exploitation is low at present, and the vulnerability is not registered in the CISA KEV catalog. Because the flaw is DOM‑based and relies on the plugin generating un‑sanitised HTML from user input, an attacker most likely needs to supply malicious data in a block or custom content field to trigger the script, a scenario that requires knowledge of the site’s usage patterns but does not demand privileged access.