The Services Section Block – Showcase Service Details plugin contains a flaw in the "link" block attribute that allows an authenticated contributor or higher to embed arbitrary JavaScript into the link value. The malicious script is stored within the post_content field inside an HTML comment, bypassing WordPress's wp_kses_post sanitization at save time. When a visitor loads a page that includes the affected service block, the payload executes in that visitor's browser, enabling the attacker to run code, hijack sessions, deface content, or conduct further web‑based attacks. This is a classic stored cross‑site scripting vulnerability with the potential for widespread impact on all users who view the compromised page.

All WordPress sites that use the Services Section Block plugin version 1.4.4 or earlier are affected. Any installation running those versions exposes its content pages to the stored XSS flaw.

The vulnerability has a CVSS score of 6.4, reflecting moderate severity. The EPSS score is below 1%, indicating a low probability of exploitation in the wild as of the current data, but it is not zero and therefore still a concern. The flaw is not catalogued in the CISA KEV database. Attackers need only contributor-level access or higher; they can embed the payload, which then persistently affects all users who visit the page. The low entry barrier for privileged users combined with the potentially high impact makes this a tangible risk for sites that grant contributor rights to many users or have compromised accounts.