This flaw allows authenticated users with contributor privileges to embed arbitrary JavaScript into page content via multiple Gutenberg blocks. The insufficient sanitization of user‑supplied attributes causes the stored scripts to execute in the browsers of any visitor who loads a page containing the compromised block.

The vulnerability affects the ZoloBlocks – Gutenberg Block Editor Plugin by bdthemes. Versions up to and including 2.3.10 are vulnerable. WordPress sites with this plugin installed and that grant contributor or higher roles the ability to create or edit blocks are at risk.

The CVSS score of 6.4 indicates a medium severity flaw, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the immediate future. The vulnerability is not listed in the CISA KEV catalog, meaning no widespread exploitation has been recorded. The attack requires authenticated contributor access, so site administrators should audit user roles, limit block editing permissions, and apply a patch as soon as possible.