This vulnerability (CVE-2025-68605) affects PickPlugins Post Grid and Gutenberg Blocks versions up to 2.3.23. It is caused by improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). The CVSS 3.1 base score is 6.5 (medium), with attack vector network, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability. No known exploits are reported in the wild. No patch or mitigation details are currently available from the vendor.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to partial compromise of confidentiality, integrity, and availability of the system. The CVSS vector indicates that exploitation requires some privileges and user interaction, limiting the ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting privileges and minimizing user interactions that could trigger the vulnerability. Monitor official PickPlugins communications for updates and apply any official fixes promptly once released.