This vulnerability is a stored cross‑site scripting flaw in the SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin. It is a CWE‑79 type weakness where user‑supplied attributes for the plugin’s Countdown block are neither sanitized nor properly escaped when stored. As a result, any authenticated user with contributor‑level access or higher can embed arbitrary JavaScript into a page. When visitors load the affected page, the injected scripts will execute within their browsers, potentially altering page content or injecting additional malicious code.

The affected product is the SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) WordPress plugin, versions up to and including 1.6.0. All WordPress sites that install these versions and use the Countdown block are impacted.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. However, because the attack requires only contributor‑level access, an attacker with a compromised or malicious contributor account can quickly insert harmful scripts into site pages. The impact is limited to the browsers of visitors who view the injected page, but the injected script could alter page content or deface the site.