The vulnerability arises from the Dealia – Request a Quote WordPress plugin improperly escaping user‑supplied data in Gutenberg block attributes. The code uses wp_kses when an attribute context requires esc_attr, allowing malicious scripts to be embedded and stored in the page content. An authenticated user with Contributor level or higher can inject these scripts, which execute in the browsers of any visitor to the affected page, potentially leading to session hijacking, defacement, or other client‑side attacks.

All versions of the Dealia – Request a Quote plugin up to and including 1.0.8 are affected. The vulnerability requires a user with at least Contributor privileges on a WordPress site that hosts the plugin. No specific operating system or server configuration is mentioned.

With a CVSS score of 6.4, the vulnerability is considered moderate risk. The EPSS score is below 1 %, indicating a low likelihood of exploitation under current conditions, and it is not listed in CISA’s KEV catalog. The attack vector is web‑based and relies on authenticated access, meaning it only affects sites where an attacker has gained Contributor or higher permissions. The stored nature of the flaw means the malicious script remains in the content until removed or the plugin is fixed, allowing repeated exploitation of any user who loads the affected page.