The Blocksy WordPress theme is vulnerable to stored cross‑site scripting because the blocksy_meta metadata fields lack proper input sanitization and output escaping in all releases up to 2.1.30. Authenticated users with Contributor role or higher can inject arbitrary JavaScript into these fields, causing the code to run whenever any visitor opens an affected page. Based on the description, it is inferred that such injected scripts could be used to steal session cookies, deface the site, or launch additional attacks against site users, although these specific consequences are not explicitly stated in the CVE text.

All installations of the Blocksy theme from its initial release up to and including version 2.1.30 are vulnerable. The theme is distributed by CreativeThemes under the Blocksy identifier on WordPress.

The vulnerability scores 6.4 on CVSS, indicating moderate severity. The EPSS score is less than 1%, implying a low probability of exploitation at present. It is not listed in the CISA KEV catalog. The attack requires authenticated access; an attacker must be a Contributor or have higher privileges to insert malicious content into the blocksy_meta fields. The likely attack vector is an authenticated content injection via the theme’s metadata editor.