The Timeline Blocks for Gutenberg plugin is vulnerable to stored Cross‑Site Scripting due to the lack of proper input sanitization and output escaping on the 'titleTag' block attribute. An attacker who can authenticate with contributor or higher privileges can inject malicious JavaScript into the attribute, which is then persisted in the database. When any user loads a page containing the injected block, the script executes in the context of the page, permitting attacks such as defacement, cookie theft, or other client‑side compromise.

WordPress sites running the Timeline Blocks for Gutenberg plugin, any version up to and including 1.1.10.

With a CVSS score of 6.4 the vulnerability represents a moderate severity risk. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, but the attack vector remains clear: an authenticated contributor or higher user can insert malicious payloads. The stored nature of the flaw means the impact is permanent until the page is regenerated or the payload removed, potentially affecting all visitors to the affected posts.