This vulnerability arises from a lack of input sanitization and output escaping for the 'tagName' attribute of blocks in the Meta Field Block plugin. Attackers who possess contributor or higher privileges can store arbitrary JavaScript in this attribute. When a page containing the malicious block is viewed, the injected script executes in the context of any user who visits the page, potentially enabling cookie theft, session hijacking, defacement, or other malicious actions. The weakness is a classic reflected or stored cross‑site scripting flaw (CWE‑79).

The Meta Field Block WordPress plugin, versions up to and including 1.5.2. Affected installations run WordPress and have this plugin configured; users with contributor-level access or higher can inject the payload via the block editor.

The CVSS score of 6.4 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread, actively exploited instances reported at this time. The likely attack vector requires authenticated use of the Block Editor; attackers must have contributor or higher permissions to add or edit blocks. Once malicious content is stored, any user who views the page can be affected.