The Osom Blocks WordPress plugin suffers from a stored XSS vulnerability due to improper neutralization of input in the 'class_name' parameter. This allows authenticated contributors or higher to inject malicious scripts into pages, which execute upon page access by other users. The vulnerability is tracked as CVE-2025-5940 with a CVSS 3.1 score of 6.4 (medium severity). No patch or remediation details have been provided, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

An attacker with Contributor-level or higher privileges can exploit this vulnerability to inject persistent malicious scripts into WordPress pages. This can lead to unauthorized script execution in the context of users viewing the infected pages, potentially resulting in session hijacking, privilege escalation, or other client-side attacks. The impact is limited to confidentiality and integrity with no direct availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Osom Blocks plugin if feasible. Monitor vendor channels for updates and apply patches promptly once available.