The vulnerability is an improper neutralization of input during web page generation that allows an attacker to store malicious script code within the WordPress Blockons plugin. When the stored content is later rendered in a browser, the malicious code executes in the context of users who view the page, potentially allowing theft of session cookies, defacement, or other client‑side attacks. This reflects a classic Stored XSS weakness per CWE‑79.

Kaira’s Blockons WordPress plugin for the Blockons blockons feature is affected on all releases up to and including 1.2.19. Any WordPress site that has installed these versions is potentially vulnerable.

The CVSS base score of 6.5 indicates a moderate impact. The EPSS score is less than 1 %, suggesting a very low exploitation probability at the moment of evaluation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an adversary entering malicious script into a content field or form provided by the plugin, which is then stored and subsequently rendered to other site visitors. Users who view the affected page will have the injected script executed in their browsers, providing the attacker with client‑side capabilities.