This vulnerability is an improper neutralization of input during web page generation that permits malicious scripts to be reflected in browser responses. An attacker can craft a URL or input containing JavaScript code that is executed in the victim’s browser when the page is loaded, potentially enabling credential theft, session hijacking, or defacement. The weakness corresponds to CWE‑79 and can compromise the confidentiality and integrity of the affected site.

The flaw affects the ThemeHunk Gutenberg Blocks"Unlimited Blocks For Gutenberg" plugin on WordPress installations with version 1.2.8 or earlier. Sites using this plugin, regardless of other WordPress components, are vulnerable until the plugin is upgraded beyond the stated limit.

The EPSS score is below 1%, indicating a low probability of widespread exploitation, and the vulnerability has not been listed in the CISA KEV catalog. However, the attack vector is likely remote via a crafted URL or form input, requiring the victim to visit a malicious link. The CVSS severity is not explicitly provided, but the presence of reflected XSS typically translates to a moderate to high impact if it can reach privileged users. Until patched, the vulnerability remains actively exploitable by opportunistic actors.