Improper neutralization of input in the bPlugins Advanced Post Block - Post Grid for WordPress block editor leads to a stored Cross‑Site Scripting flaw. When a malicious payload is inserted into the plugin’s content—such as within a post or widget—it is persisted in the database and then rendered into the page without sanitization. Any visitor who loads the affected page will have the injected JavaScript executed in their browser, potentially allowing cookie theft, session hijacking, or defacement.

The vulnerability affects all releases of the bPlugins Advanced Post Block - Post Grid for WordPress block editor up to and including version 2.5.1. Any site running the plugin within that version range is at risk, regardless of the WordPress version or other plugins.

With a CVSS score of 6.5 the flaw is considered moderate severity. The EPSS score is not available, and it does not appear in the CISA KEV catalog. Attackers would most likely need to inject a payload through an authorized user interface, such as the post editor, and the stored XSS would then affect all visitors who view the modified page. Because the vulnerability is stored, exploitation does not require further user interaction beyond initial content creation.