The Otter Blocks plugin for WordPress suffers from a stored XSS vulnerability via the id parameter in the google-map block. This occurs because the plugin does not properly sanitize or escape input, allowing authenticated users with contributor or higher roles to inject malicious scripts. These scripts execute in the context of any user who views the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability is tracked as CVE-2024-2226 and is classified under CWE-20 (Improper Input Validation). No patch or official fix information is provided in the available data.

An attacker with contributor or higher privileges can inject persistent malicious scripts into pages using the vulnerable google-map block. These scripts execute in the browsers of users who access the infected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the google-map block in the Otter Blocks plugin to prevent exploitation.