The Responsive Blocks – WordPress Gutenberg Blocks plugin is vulnerable to stored cross-site scripting via the 'section_tag' parameter due to improper input neutralization. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. This vulnerability is present in all versions up to 1.9.9. The CVSS 3.1 base score is 6.4 (medium), reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and partial impact on confidentiality and integrity but no impact on availability. No patch or remediation details are provided in the available data.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to partial disclosure of confidential information and modification of data within the affected site context. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the vulnerable plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.