The Page Builder Gutenberg Blocks – CoBlocks WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) in its Icon Widget. This vulnerability allows authenticated users with contributor-level or higher permissions to inject arbitrary JavaScript code via the link value due to inadequate input sanitization and output escaping. When other users access pages containing the injected script, the malicious code executes in their browsers. The vulnerability affects all plugin versions up to 3.1.6. The CVSS 3.1 score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. The scope is changed, impacting confidentiality and integrity but not availability. No patch or official remediation guidance is currently documented.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the context of users viewing those pages. This can lead to theft of sensitive information, session hijacking, or other client-side attacks impacting confidentiality and integrity. Availability is not affected. The vulnerability requires authenticated access with contributor or higher privileges, limiting the attack surface to users with such permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the affected Icon Widget if feasible. Monitor for updates from the vendor or plugin maintainers for a security patch addressing this vulnerability.