The PublishPress Blocks plugin for WordPress is vulnerable to stored cross-site scripting through the Marker Title and Marker Description fields used in the Maps block. Insufficient input sanitization and output escaping allow an attacker who can authenticate as a contributor or higher to insert arbitrary JavaScript that will execute whenever any user loads a page containing the injected content. This can result in session hijacking, credential theft, and other client-side attacks or unauthorized content manipulation.

The vulnerability affects the PublishPress Blocks – Block Controls, Block Visibility, Block Permissions plugin for WordPress, specifically versions up to and including 3.3.4. Any WordPress site running this plugin with contributor-level access or higher is at risk.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the near term. Because the vulnerability is not listed in CISA's KEV catalog, it is not known to have been exploited in the wild. The attack requires authenticated access with contributor-level or higher privileges, which many content-based sites may grant. Once exploited, scripts injected via Marker fields run in the browser context of any user who visits the affected page.