The BlockArt Blocks plugin for WordPress contains a stored cross‑site scripting vulnerability via the ‘clientId’ block attribute. The deficiency in input sanitization and output escaping allows an authenticated user with "Author" or higher privileges to embed arbitrary JavaScript, which is then executed whenever any visitor loads the affected page. This flaw gives attackers the capability to manipulate or hijack the browsing session, potentially exfiltrating credentials or performing additional actions on behalf of the user, thereby violating the integrity and confidentiality of the site.

All installations of the BlockArt Blocks WordPress plugin up through and including version 2.2.15 are affected. The product is distributed by the vendor WPBlockArt and is used as a Gutenberg block and page‑builder plugin within WordPress sites.

The CVSS v3.1 score of 6.4 reflects moderate severity and the presence of user‑level authentication. Exploitation requires only author‑level access, an achievable privilege on most sites, and does not require additional conditions. No EPSS score is available and the vulnerability is currently not listed in the CISA KEV catalog, but the stored nature of the flaw means the impact can be persistent for all site visitors. While not immediately exploitable by unauthenticated attackers, any user with author access can carry out the injection, making timely patching prudent.