The Vayu Blocks – Website Builder for the Block Editor plugin contains insufficient input sanitization and output escaping for the Lottie block in all releases up to 1.3.9. Authenticated users with Contributor access or higher can inject arbitrary JavaScript into block attributes, which is stored and executed when any user opens the affected page. This flaw enables a persistent cross‑site scripting attack that affects the confidentiality and integrity of the site’s users’ browsers without requiring additional privileges.

The vulnerability affects the WordPress plugin Vayu Blocks – Website Builder for the Block Editor developed by Themehunk. All versions of the plugin up to and including 1.3.9 are impacted. The flaw exists in the handling of attributes for the Lottie block and is not limited to a specific sub‑feature or configuration.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. An attacker must first obtain Contributor‑level or higher authentication, then supply malicious content in a block attribute; the injected script is persisted and will fire for every visitor who loads the amended page. Given the moderate severity and limited exploit probability, the risk is moderate, but the impact remains significant for users who visit the compromised pages.