Improper Neutralization of Input During Web Page Generation is present in the GoDaddy CoBlocks WordPress plugin up to version 3.1.16. The flaw enables an attacker to embed malicious script that is stored on the site, causing it to execute whenever a visitor loads an affected page. This stored XSS can lead to session hijacking, credential theft, or defacement of the site. The vulnerability stems from insufficient sanitization of user‑supplied data and is identified as CWE‑79.

All installations of the CoBlocks plugin distributed by GoDaddy, specifically those using versions from the earliest available release through 3.1.16, are vulnerable. Site owners who have not applied a newer version of the plugin are at risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% reflects a low yet non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The stored nature of the XSS means an attacker who can add or edit content through the plugin’s interface can inject malicious code that persists for all users. The likely attack vector is the plugin's administrative interface or content submission forms, implying that users or admins with content‑creation privileges could be compromised, creating a broad impact on site visitors.