The Nexter Blocks plugin for WordPress is affected by a stored cross‑site scripting flaw that allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript into widget attributes. The vulnerability stems from insufficient input sanitization and output escaping, which causes malicious scripts to execute whenever a page containing the injected widget is rendered.

This flaw exists in all releases of Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder up to and including version 4.5.4, developed by posimyththemes. WordPress sites that have installed the plugin and possess contributor‑level or higher accounts are impacted.

The CVSS score of 6.4 indicates medium severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with at least contributor privileges to add or edit a widget; after the payload is stored, it runs for every visitor who accesses the affected page.