Contributor Cross Site Scripting (XSS) is present in the WordPress Magazine Blocks plugin, versions 1.8.3 and earlier. An attacker who can assume a contributor role may inject malicious script payloads into site content. When a visitor loads a page containing the injected script, the attacker can execute arbitrary code in that visitor’s browser, potentially stealing credentials, defacing the website, or redirecting the user to malicious sites. The vulnerability is an input validation flaw, categorized as CWE‑79.

WordPress sites that use the BlockArt Magazine Blocks plugin version 1.8.3 or earlier are affected. Updating later removes the vulnerability.

The CVSS score of 6.5 indicates a medium level risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of exploitation is uncertain. If a contributor account can be compromised or created, the attacker can directly inject the XSS payload into the site content, potentially affecting all site visitors who load the affected pages.