The Post Blocks & Tools WordPress plugin suffers from a stored XSS vulnerability (CWE-79) in the 'sliderStyle' block attribute of the Posts Slider block. This flaw arises from inadequate sanitization and escaping of user-supplied input, allowing authenticated users with author-level access or above to inject arbitrary JavaScript code. The injected scripts execute in the context of any user viewing the compromised page, potentially leading to session hijacking or other client-side attacks. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level. No patch or official remediation is currently documented.

An attacker with author-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable attribute. These scripts execute in the browsers of users who visit the infected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The impact is limited to confidentiality and integrity loss at a low level, with no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider disabling or removing the Posts Slider block if feasible to reduce exposure.