This vulnerability in WP Engine's Gutenberg Blocks – ACF Blocks Suite (acf-blocks) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). It affects all versions up to 2.6.11. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, low privileges, and user interaction, with a scope change and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the vulnerability is publicly disclosed as of June 20, 2025.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to information disclosure, modification of data, or disruption of service. The attack requires low privileges and user interaction, and it affects the confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input in the affected plugin and consider applying temporary mitigations such as input sanitization or disabling vulnerable blocks if feasible.