The vulnerability allows an attacker with contributor or higher privileges to inject arbitrary JavaScript into the 'data-image-points' attribute of the Getwid – Gutenberg Blocks plugin. This script is stored and then executed on other users’ browsers when they view the affected page, resulting in a classic stored XSS flaw that can compromise victim credentials or enable session hijacking. The weakness exists because the plugin fails to sanitize or escape user‑supplied input before outputting it, as identified by CWE‑79. The impact is limited to a single user session for each victim user who views the injected page, but the malicious script can affect all users who access that page.

Getwid – Gutenberg Blocks WordPress plugin, versions up to 3.0.1, on installations that provide contributor or higher roles.

A CVSS of 6.4 reflects a medium‑severity stored XSS that needs contributor or higher authentication. The EPSS score is not available, and the issue is not in CISA KEV. The attacker must log in as a contributor or higher to insert the payload, but any user who views the page will execute the injected script. No additional prerequisites are listed beyond the required authentication level.