This vulnerability is a reflected cross‑site scripting flaw caused by the Stiofan BlockStrap Page Builder – Bootstrap Blocks plugin failing to properly escape user input before it is rendered in a page. The plugin accepts arbitrary data, incorporates it directly into the HTML output, and as a result an attacker can embed malicious scripts that run in the browsers of any visitor to the affected page. The weakness is identified as CWE‑79, an input validation flaw that undermines web‑application security by allowing an adversary to execute client‑side code and potentially hijack sessions, deceive users, or exfiltrate data.

The issue affects the WordPress BlockStrap Page Builder – Bootstrap Blocks plugin for all releases up to and including version 0.1.58. Any WordPress site that has installed a version in that range is potentially vulnerable unless mitigated or upgraded to 0.1.59 or later.

The CVSS score of 7.1 indicates the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so no well‑known exploits are documented. The likely attack vector is a malicious URL or form input that the plugin reflects back, allowing a remote attacker to trigger script execution or otherwise manipulate the page content for anyone who views the affected page. Because the vulnerability is remote and does not require special credentials, the risk is significant for sites with public users.