The vulnerability arises from insufficient sanitization of the block_id attribute in the Gutentools Post Slider block. Authenticated users with Contributor or higher permissions can inject malicious scripts that are stored and rendered unsafely, enabling arbitrary JavaScript execution in the browsers of any site visitor. This can lead to session hijacking, data theft, defacement, or other client‑side compromise. The weakness is a classic input validation flaw, classified as CWE‑79.

All installations of the Gutentools plugin for WordPress running versions up to and including 1.1.3 are affected by this flaw. No other products are listed as impacted.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, which limits publicly known exploitation data. The attack requires authenticated access with Contributor or higher permissions; an attacker must create or edit a Post Slider block and supply a malicious block_id value. Once embedded, the script executes in the browsing context of any user who views the page, making the exploitation path straightforward once the required permissions are achieved. Because the flaw is client‑side, the risk revolves around compromising users who view affected content rather than direct server‑side code execution.