The Stackable – Page Builder Gutenberg Blocks plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-2039. This vulnerability exists due to improper neutralization of input during web page generation, specifically in the Post(v2) block title tag. Authenticated attackers with contributor or higher privileges can inject malicious scripts that persist in pages and execute in the context of users viewing those pages. The vulnerability affects all versions up to 3.12.11. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact. There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

Successful exploitation allows authenticated contributors or higher to inject persistent scripts into pages, which execute in the browsers of users who view those pages. This can lead to partial compromise of confidentiality and integrity of user data within the affected WordPress site context. There is no direct impact on availability. The medium CVSS score reflects a moderate risk given the required privileges and potential impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions carefully and consider removing or disabling the affected Post(v2) block if possible. Monitor official bfintal communications and WordPress plugin repositories for updates addressing this vulnerability.