The Ultimate Blocks – Gutenberg Blocks Plugin contains a CWE-79 vulnerability where user input is not properly sanitized before being included in web pages, enabling stored cross-site scripting attacks. This can lead to the execution of arbitrary scripts in the context of users interacting with the plugin's content. The vulnerability affects all versions up to 3.1.9. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low and low respectively. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing affected content, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The overall severity is medium based on the CVSS score of 6.5. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting plugin usage or applying additional input sanitization controls if possible. Monitor official Ultimate Blocks communications for updates on patches or mitigations.