The vulnerability resides in the Blocksy Companion plugin for WordPress, where the 'tagName' attribute of the dynamic-data block is rendered without adequate input sanitization or output escaping. Because the plugin accepts author‑level user input, an authenticated attacker can inject arbitrary JavaScript that is stored in the page content and executed whenever the page is viewed by anyone. This is a stored cross‑site scripting flaw and satisfies CWE‑79. The injected script runs in the context of the affected website, potentially allowing credential theft, defacement, or the execution of further malicious actions against site visitors.

The flaw affects every WordPress site that installs the Blocksy Companion plugin version 2.1.51 or earlier. The vulnerability is confined to the plugin; therefore, only sites using this plugin are impacted. The vendor is creativethemeshq, and the product is Blocksy Companion. All installations that have not been upgraded to 2.1.52 or newer are considered vulnerable.

The CVSS score of 6.4 indicates a moderate severity, and the absence of an EPSS score shows that no publicly reported exploitation attempts have been tracked. The vulnerability does not require network‑exposed access; it can be triggered by any authenticated user with author or higher privileges on the WordPress site. If an attacker obtains such credentials, they can run the stored script against all visitors, creating a broad threat of credential compromise or defacement. Because the flaw already exists in the public plugin, the risk to any site that has not updated is moderate to high, and an immediate upgrade is recommended.