CVE-2025-3276 is a stored cross-site scripting vulnerability (CWE-79) in the SKT Blocks – Gutenberg based Page Builder WordPress plugin, specifically in the Post Carousel block. The flaw allows authenticated users with Contributor or higher privileges to inject arbitrary web scripts due to improper input neutralization during page generation. This can lead to script execution in the context of users viewing the compromised pages. The vulnerability affects all versions up to and including 1.9. The CVSS 3.1 score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level.

Successful exploitation allows authenticated users with Contributor-level access or above to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to information disclosure or session hijacking but does not impact availability. The vulnerability does not require user interaction beyond viewing the compromised page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or avoiding use of the Post Carousel block. Monitor for updates from the plugin vendor or WordPress security advisories.