The Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the contact form file field CSS metabox. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts that execute in the context of users viewing the compromised pages. This vulnerability affects all versions up to and including 2.6.3. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges of low (contributor), no user interaction, and impacts on confidentiality and integrity with no availability impact. No patch or official fix has been documented in the provided data.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute when viewed by other users. This can lead to unauthorized disclosure of information and unauthorized modification of content within the affected WordPress site. There is no indication of availability impact or known exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the vulnerable contact form file field CSS metabox. Monitor vendor communications for updates on patches or official mitigations.