This vulnerability stems from improper neutralization of user input when Generating web page content, allowing an attacker to inject malicious scripts that are stored and later rendered to visitors. The stored XSS can execute arbitrary client‑side code, enabling session hijacking, defacement, or delivery of malware in the victim’s browser. The weakness is a classic input‑validation flaw classified as CWE‑79.

The affected product is PickPlugins Post Grid and Gutenberg Blocks for WordPress, with all releases through version 2.3.23 susceptible to the flaw.

The reported CVSS score of 6.5 reflects a moderate impact, while the EPSS score of < 1% suggests a low probability of exploitation at present. The vulnerability is not yet cataloged in CISA’s KEV list. The likely attack path involves a content author or administrator injecting a crafted block that contains malicious JavaScript; because the payload is stored, any subsequent page view will execute the script in the victim’s browser context.