The Nexter Blocks plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript into pages via multiple widgets because user input is not properly sanitized or escaped. This vulnerability affects all versions up to and including 4.5.4. The CVSS 3.1 base score is 6.4 (medium severity), with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no impact on availability. No patch or remediation details are provided in the available data.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages, which execute in the context of users viewing those pages. This can lead to unauthorized actions, data disclosure, or session hijacking affecting the confidentiality and integrity of user data. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling vulnerable widgets. Monitor for updates from posimyththemes regarding patches or official mitigations.