This vulnerability in Content Blocks (Custom Post Widget) allows stored XSS due to improper input neutralization during web page generation. It affects all versions up to 3.3.5. The attack vector is network-based with low attack complexity, requiring low privileges and user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No patch or official remediation guidance has been provided yet.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and low privileges, which reduces the overall risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to the affected plugin and monitor for suspicious activity related to stored XSS. Avoid enabling untrusted users to input content that is rendered by the plugin.