The BlockSpare plugin for WordPress, which provides Gutenberg blocks and patterns for blogs, magazines, and business sites, is vulnerable to stored cross-site scripting (CWE-79) due to improper neutralization of input during web page generation. Specifically, the HTML attributes of Image Carousel and Image Slider widgets do not adequately sanitize or escape user input, allowing authenticated users with Contributor-level permissions or higher to inject arbitrary scripts. These scripts execute in the context of any user who accesses the compromised page, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to 3.2.13.1. There is no indication of known exploits in the wild or available patches at this time.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via vulnerable widgets. This can lead to client-side script execution in users' browsers when they view the affected content, potentially compromising user sessions or performing unauthorized actions within the context of the victim's browser. The vulnerability does not affect availability and requires authenticated access, limiting its impact to confidentiality and integrity at a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or avoiding use of the Image Carousel and Image Slider widgets in the BlockSpare plugin. Monitor vendor channels for updates and apply patches promptly once available.