The scratchblocks for WP plugin contains a stored cross‑site scripting flaw caused by inadequate sanitization of the 'element' attribute in the 'scratchblocks' shortcode. Because the plugin fails to properly escape this user‑supplied attribute, an authenticated user with contributor-level access can inject arbitrary JavaScript. When a visitor opens a page that contains the maliciously crafted shortcode, the injected script runs in the visitor's browser.

Vulnerability impacts the scratchblocks for WP WordPress plugin, versions up to and including 1.0.1. The affected author is tkc49. No other versions are indicated as vulnerable in the data.

The CVSS score of 6.4 indicates a moderate severity vulnerability. EPSS data is not available, and the vulnerability is not listed in CISA KEV, implying no publicly known exploitation. However, because the exploit requires only contributor‑level authentication, it is likely to be exercised by any user who can edit content. The stored payload will be executed for all site visitors who view the affected page.