The DesignSetGo WordPress plugin contains a stored XSS vulnerability that can be triggered when an authenticated user with contributor-level access supplies a malicious value for the parameter 'tagName' used during block‑conversion migration. The vulnerable build_group_block() function absorbs the payload into post_content HTML, so any browser that loads the affected page will execute the injected script. This flaw is a classic input‑validation and output‑encoding weakness identified as CWE‑79, allowing attackers to deface sites, hijack user sessions, track users, or deliver additional malware.

All releases of the DesignSetGo plugin by justinnealey up to and including version 2.11.0 are affected. The vulnerability is tied to the block‑migration routine that runs when a site administrator deactivates and reactivates the plugin via the "Scan & Convert Blocks" option during deactivation.

The CVSS score of 4.4 indicates moderate impact. Because the flaw requires an authenticated contributor or higher to insert a payload and also relies on an administrator to trigger the migration process, the exploitation path is relatively constrained and does not allow an unauthenticated attacker to exploit the flaw alone. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting low to moderate prevalence in the wild. Nonetheless, any site that has the plugin installed and enables the block migration routine is at risk of having malicious scripts delivered to all visiting users.