CVE-2026-4125 is a stored cross-site scripting vulnerability in the WPMK Block WordPress plugin. The issue occurs because the 'class' attribute from user-supplied shortcode attributes is concatenated directly into an HTML div element's class attribute without proper escaping (e.g., esc_attr()). This allows authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript code that executes in the context of any user viewing the page containing the injected shortcode. The vulnerability affects all versions up to and including 1.0.1. The CVSS 3.1 base score is 6.4, reflecting a network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with Contributor-level or higher privileges can inject malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or other client-side impacts. The vulnerability does not affect availability. There are no known exploits in the wild at this time.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates regarding a fix. Until a patch is released, restrict Contributor-level access to trusted users only and consider removing or disabling the WPMK Block plugin if feasible. Avoid using the vulnerable shortcode attribute or sanitize inputs manually if possible.