The vulnerability is a stored cross‑site scripting flaw in the Content Blocks (Custom Post Widget) plugin. The plugin’s content_block shortcode does not properly sanitize or escape user‑supplied content, allowing an authenticated user with contributor or higher privileges to embed malicious JavaScript. When a user accesses a page containing the injected shortcode, the script executes in the victim’s browser, potentially enabling credential theft, session hijacking, or other client‑side attacks. This weakness is classified as CWE‑79.

WordPress installations running the vanderwijk:Content Blocks (Custom Post Widget) plugin in any version up to and including 3.3.9 are affected. Sites that grant contributor or higher level permissions are at risk because such users can insert the harmful content.

The CVSS score of 6.4 indicates a medium severity, and the lack of EPSS data means the current exploitation probability cannot be quantified; however, the vulnerability is not listed in the CISA KEV catalog. The attack vector requires valid credentials, and since many sites use contributor accounts, the real‑world risk is non‑negligible. Updating to a fixed release or disabling the content_block shortcode effectively eliminates the stored XSS threat.