The Highlighting Code Block plugin for WordPress allows an authenticated administrator to inject arbitrary JavaScript through the font_family setting, which is stored and rendered on any page that displays the setting. The injected code runs in the browser of every user who views the affected page, enabling credential theft, defacement, or other malicious actions. The flaw arises from insufficient input sanitization and output escaping in the plugin's admin settings.

All releases of Highlighting Code Block up to and including version 2.2.0 running on WordPress multisite installations where the unfiltered_html capability has been disabled are affected. Administrators or users with equivalent privileges can modify the font_family option and deliver malicious content.

The CVSS score of 4.4 indicates a moderate severity. The EPSS score of less than 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Because it requires authenticated administrator access to alter plugin configuration, the attack vector is restricted. However, any user who visits an affected page is at risk, so timely patching is recommended.