The Responsive Blocks WordPress plugin before version 2.3.0 fails to sanitize or escape certain form input values before incorporating them into the HTML notification email sent to the site owner, enabling an unauthenticated user to inject arbitrary HTML, such as phishing links or scripts, into that email. The primary effect is the compromise of legitimate email communications and the potential for credential theft or social engineering attacks against recipients.

All WordPress installations that use the Responsive Blocks plugin with a version lower than 2.3.0 are affected. The plugin is listed by the CNA as "Unknown:Responsive Blocks". Site administrators should confirm the plugin version and any configuration that triggers email notifications to assess exposure.

The CVSS score of 5.4 indicates a moderate risk level, and the EPSS score of 0.226% reflects a low to very low exploitation probability, though the vulnerability is still actionable. The flaw is not listed in the CISA KEV catalog. Attackers do not need authentication or elevated privileges; they only need to access the public form component of the plugin. Because the injected content goes straight into outbound emails, the attack surface is the Internet-facing form, making exploitation straightforward once the plugin is in use.