The Spectra Gutenberg Blocks plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper neutralization of input in the 'block_id' parameter. This allows authenticated users with author-level permissions or above to inject arbitrary JavaScript code into pages. When other users access these pages, the injected scripts execute, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to 2.13.0. The CVSS 3.1 score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the author level. No patch or official fix has been documented in the provided data.

An authenticated attacker with author-level permissions can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing the compromised pages. This can lead to limited confidentiality and integrity impacts, such as theft of user credentials or manipulation of page content. There is no impact on availability reported. The vulnerability requires user interaction in the form of viewing the injected page and privileges at the author level or higher to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level permissions to trusted users only and consider monitoring for suspicious script injections in page content. Avoid granting author-level access broadly. Follow updates from brainstormforce for any released patches or official mitigations.