The Cosmic Blocks (40+) Content Editor Blocks Collection WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) via its 'cwp_social_share' shortcode. This flaw arises from improper neutralization of input during web page generation, allowing authenticated contributors or higher to inject arbitrary scripts into pages. These scripts execute in the context of users who visit the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to 1.3.0. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed. No patch or vendor advisory is currently available to confirm remediation status.

An attacker with contributor-level or higher privileges can inject malicious JavaScript code into pages via the vulnerable shortcode. This code executes in the browsers of users who view the infected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the 'cwp_social_share' shortcode if feasible to reduce exposure.