The Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) via the titleTag parameter. This vulnerability allows authenticated users with Contributor or higher privileges to inject arbitrary web scripts into pages, which execute upon page access by other users. The root cause is insufficient input sanitization and output escaping of the titleTag parameter in all versions up to and including 3.6. The CVSS 3.1 base score is 6.4 (medium), with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity with scope changed. There is no vendor advisory or patch link provided, and no known exploits in the wild have been reported.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the titleTag parameter. These scripts execute in the context of users viewing the infected pages, potentially leading to unauthorized disclosure of information or modification of content. The vulnerability affects confidentiality and integrity but does not impact availability. Since the attacker must have authenticated access, the risk is limited to environments where such access is granted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the Rise Blocks plugin. Monitor for plugin updates from eaglethemes and apply them promptly once released. Avoid exposing sensitive data on pages built with this plugin to reduce potential impact.