The GutenBee – Gutenberg Blocks plugin is vulnerable to stored cross‑site scripting because it fails to sanitize or escape data entered through the CountUp and Google Maps blocks. At the time of exploitation, an authenticated user with Contributor or higher privileges can inject arbitrary JavaScript that will run in the browsers of any user who views the page containing the block. The resulting impact is the ability to steal session cookies, deface the site, or perform other malicious actions on behalf of visitors.

Systems running the Gutenberg Blocks plugin from cssigniterteam <= 2.18.0 are affected. This includes any WordPress installation that has the plugin installed and where an attacker has at least Contributor level access to edit content.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exfiltration or disruption can be achieved by an attacker once they have the necessary role to edit the vulnerable blocks. The attack vector requires authenticated access, but the stored nature of the payload means that it will affect all users who view the affected pages.