The Rootblox plugin for WordPress fails to properly neutralize user input when generating web pages, enabling stored cross‑site scripting (XSS). An attacker can inject malicious scripts that will be rendered for all users viewing affected content, permitting session hijacking, defacement, or injection of malware. The vulnerability is a classic input validation flaw (CWE‑79).

CozyThemes Rootblox plugin versions up to and including 1.0.7 are affected. Users of WordPress sites who have installed any of these versions should verify their plugin version and upgrade if necessary.

With a CVSS score of 6.5, the vulnerability is of moderate severity. There is no EPSS score available and the issue is not listed in the CISA KEV catalog, suggesting no publicly confirmed exploit activity yet. The likely attack vector is through the plugin’s data input interface; any user or attacker who can submit data that the plugin stores could trigger the XSS. Because the flaw is stored, a single exploit can affect all visitors to the compromised content site.