The Canvas WordPress plugin accepts a 'tag' attribute in several block rendering components, but does not properly sanitize or escape its value. When a contributor or higher‑privilege user supplies malicious content as the tag, the plugin stores it in the database and later includes it unfiltered when rendering the page. The injected script runs in any visitor’s browser, providing the attacker with access to client‑side information, session cookies, and the ability to perform actions on behalf of that user. This vulnerability is a classic stored cross‑site scripting flaw (CWE‑79).

Any WordPress site using the Canvas plugin version 2.5.2 or earlier is vulnerable. The affected vendor is CodeSupplyCo under the Canvas plugin product line. Updating to Canvas 2.5.3 or later removes the flaw.

The CVSS score of 6.4 indicates a moderate severity risk. Because the exploitation requires authenticated contributor access, the attack vector is likely an insider or compromised contributor account. Although an EPSS score is not available, the flaw remains a real threat, especially in environments where contributors are granted access. The vulnerability is not listed in the CISA KEV catalog, but it can still be actively exploited if a site’s contributor base is not properly monitored.