CVE-2025-30951 describes a stored cross-site scripting vulnerability in the Stiofan BlockStrap Page Builder - Bootstrap Blocks plugin, versions up to 0.1.36. The vulnerability is due to improper neutralization of input during web page generation, which can allow attackers to inject and store malicious scripts that execute in the context of users viewing the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low. No patch or official fix information is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, the attack requires some level of privilege and user interaction, and the overall severity is medium. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and consider applying any future patches promptly. Until a fix is available, restricting privileges and limiting user interactions with untrusted content may reduce risk.