The Post Blocks & Tools plugin for WordPress permits authenticated users with author privileges or higher to inject arbitrary JavaScript into the sliderStyle block attribute of the Posts Slider block. Because the plugin fails to sanitize input or escape output when rendering the attribute, the injected code is stored in the database and will execute in every browser that loads affected pages. This vulnerability allows attackers to run malicious scripts in victims’ browsers, potentially facilitating session hijacking, credential theft, defacement, or phishing.

WordPress sites that have the Post Blocks & Tools plugin installed version 1.3.0 or older are impacted. The defect is present in all releases up to and including 1.3.0. Updating to 1.3.1 or later removes the flaw.

The CVSS score of 6.4 classifies the issue as medium severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires author‑level authentication, so attackers must have legitimate access to the WordPress installation. Once authenticated, they can trivially inject payloads via the sliderStyle attribute; no additional privileges or elevated privileges are needed beyond author rights. Although the vulnerability does not grant remote code execution, it can facilitate a wide range of XSS‑based attacks.