The vulnerability exists in the Stackable – Page Builder Gutenberg Blocks WordPress plugin; the update_block_style endpoint does not properly sanitize or escape input, allowing a stored cross‑site scripting (XSS) payload to be written into block styles. An attacker who is authenticated with contributor‑level or higher privileges can inject arbitrary scripts that execute whenever a user loads the affected page. The CVSS score of 6.4 indicates a moderate impact level for web‑based attacks.

All releases of Stackable – Page Builder Gutenberg Blocks up to and including version 3.19.9 on WordPress sites are vulnerable. The issue is confined to the plugin component and does not affect the core WordPress installation.

The vulnerability requires authenticated access at contributor level or higher, a privilege that is often granted to content authors or editors. The lack of input validation creates a stored XSS vector where a malicious script is permanently saved into a page’s block style and subsequently executed for any user who views that page. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue, so the likelihood of widespread exploitation is currently uncertain, yet the potential for user‑privilege escalation and phishing remains.