An attacker can inject arbitrary JavaScript into a page rendered by the Nova Blocks plugin because the plugin fails to neutralize user‑played data. The flaw is a classic Cross‑Site Scripting issue that can be used to hijack user sessions, deface content, or redirect victims to malicious sites. The weakness is identified as CWE‑79.

The vulnerability exists in pixelgrade Nova Blocks for all versions up through 2.1.9. Users running any of these releases should be aware that the plugin interprets content from untrusted sources without proper sanitization.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation at the time of this analysis, and the vulnerability is not listed in CISA’s KEV catalog. However, because it is DOM‑based and can be triggered by crafted content inserted through the plugin interface, the attack vector likely requires an attacker to get the vulnerable site to render a page containing malicious code—such as by creating or editing a block through the WordPress editor. The lack of a public exploit does not eliminate the risk, but the low exploitation probability reduces the immediacy of a widespread threat.