The WPMK Block plugin fails to sanitize or escape the value of the class shortcode attribute before inserting it into a div element’s class attribute. This flaw allows an authenticated user with at least Contributor privileges to embed arbitrary JavaScript within the content that is stored in the database. When a page containing the malicious shortcode is viewed, the injected script executes in the context of the site, potentially granting the attacker access to user session data, enabling credential theft, or defacing the site. The weakness aligns with CWE‑79, a classic unsanitized input leading to XSS.

WordPress sites that have the WPMK Block plugin installed in any version up to and including 1.0.1 are affected. Administrators should verify the installed plugin version; any site running version 1.0.1 or earlier is vulnerable. The plugin is maintained by wpmkorg under the WPMK Block product name.

The flaw is a stored XSS that requires only Contributor level access, a common role on many WordPress sites, making the attack vector fairly wide. The CVSS score of 6.4 indicates a moderate to high severity. The EPSS score is not available, so exploitation likelihood is unclear, but the lack of a published exploit and absence from the CISA KEV catalog suggest lower current exploitation risk. Nonetheless, an attacker could remotely inject malicious scripts that execute for any user who visits the affected pages, so the risk of confidentiality and integrity compromise remains significant.