The Gotham Block Extra Light plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to inadequate sanitization and escaping of input in admin settings. Authenticated administrators can inject malicious scripts that execute when users access affected pages. This vulnerability affects multi-site setups and installations with unfiltered_html disabled, impacting all versions up to and including 1.5.0. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction. There is no vendor advisory or patch information available at this time.

An authenticated attacker with administrator-level permissions can inject malicious scripts into pages, which execute when accessed by users, potentially leading to limited confidentiality and integrity impacts. The vulnerability does not affect availability. It is limited to multi-site WordPress installations or those with unfiltered_html disabled, reducing the scope of impact. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit administrator access to trusted users only and consider disabling or avoiding use of the Gotham Block Extra Light plugin in multi-site environments or where unfiltered_html is disabled. Monitor official gothamdev channels for updates regarding patches or mitigations.