The Post Blocks & Tools WordPress plugin suffers from a stored XSS vulnerability (CWE-79) via the 'sliderStyle' block attribute in the Posts Slider block. This occurs because user-supplied input is not properly sanitized or escaped before being rendered, allowing authenticated users with author-level access or higher to inject arbitrary JavaScript code. The injected scripts execute in the context of any user viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The issue affects all versions up to 1.3.0. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker with author-level or higher access can inject persistent malicious scripts into pages via the vulnerable attribute. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure or user session compromise. The vulnerability does not affect availability and requires authenticated access, limiting its scope. The CVSS score of 6.4 reflects a medium severity impact with low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and consider disabling or removing the Post Blocks & Tools plugin if feasible. Monitor for updates from the plugin developer and apply patches promptly once available.