The Button Block plugin contains an improper neutralization of input that allows malicious code to be stored and later rendered on web pages. This stored XSS flaw, classified as CWE‑79, enables an attacker to inject arbitrary JavaScript into pages viewed by users, potentially compromising confidentiality, integrity or availability of affected browsers and exposing sensitive data or allowing actions on behalf of the user.

The flaw exists in the bPlugins Button Block WordPress plugin up to and including version 1.2.7. Any installation running a version 1.2.7 or older on a WordPress site is potentially vulnerable, regardless of the WordPress core version.

The CVSS score of 6.5 indicates moderate severity and suggests that an attacker could achieve moderate impact on a targeted site. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, which does not preclude exploitation. The likely attack vector is through the plugin’s input interface, where an attacker can store malicious script that is subsequently rendered in the site’s HTML.