This vulnerability in Ryo Arkhe Blocks (<= 2.27.0) involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). An attacker with at least some privileges and requiring user interaction can inject malicious scripts that execute in the context of other users, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low complexity, privileges required, user interaction required, and scope changed.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The impact is rated medium severity with partial loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit privileges of users who can input data into the affected plugin and consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting this component.