Improper neutralization of input during web page generation allows a stored cross‑site scripting flaw in the Bricksable for Bricks Builder plugin. The weakness originates from unsanitized user‑supplied data stored in plugin settings, enabling execution of arbitrary JavaScript in the context of a site visitor's browser. This can lead to cookie theft, session hijacking, or defacement when a malicious script runs.

The vulnerability affects the Bricksable for Bricks Builder WordPress plugin up to and including version 1.6.83. Any WordPress installation that uses this plugin in those versions is potentially vulnerable.

The CVSS base score of 5.9 indicates a moderate severity level. With no EPSS data and the issue not listed in KEV, exploitation is considered unlikely, yet the stored XSS nature means any attacker who can inject content—such as a compromised user account or an administrative exploitation—could deliver scripts to all site visitors. The likely attack vector is an attacker inserting malicious payloads into plugin data that is later rendered without proper escaping.