The vulnerability in the DLX Plugins Custom Query Blocks plugin is a stored cross‑site scripting flaw that allows an attacker to inject malicious scripts into web pages rendered by the site. This type of weakness (CWE‑79) means that any user who views the affected pages can have arbitrary JavaScript executed in their browser, potentially leading to session hijacking, credential theft, or defacement of content. The vulnerability can compromise confidentiality, integrity and availability of the site’s data for all visitors.

The issue affects the DLX Plugins Custom Query Blocks plugin for WordPress. All installations using version 5.6.0 or earlier are vulnerable; the plugin is known to be distributed under the name Custom Query Blocks. No specific older versions are listed, so any earlier releases may also be affected.

The CVSS score is 6.5, indicating moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the plugin’s configuration interface that stores user input in the post‑type‑archive‑mapping setting, enabling malicious code to be persisted and served to visitors. Because the payload is stored, an attacker who gains access to the plugin’s settings or can trick an administrator into submitting forged data can affect all users who view the impacted pages.