The Vayu Blocks plugin for WordPress and WooCommerce is vulnerable to stored cross-site scripting via the 'containerWidth' parameter due to missing capability checks and inadequate input sanitization in the vayu_blocks_option_panel_callback() function. This allows authenticated users with low-level privileges (Subscriber and above) to inject arbitrary scripts that execute in the context of other users viewing the injected pages. The vulnerability affects all versions up to 1.3.1. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with no impact on availability. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

An attacker with Subscriber-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to unauthorized disclosure of information and modification of data within the affected site context. There is no indication of availability impact. The vulnerability could be leveraged to compromise user sessions or perform actions on behalf of other users, but only within the scope of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and capabilities to trusted users only, and consider disabling or removing the Vayu Blocks plugin if possible. Monitor for updates from themehunk regarding a security patch addressing this vulnerability.