The Maxi Blocks WordPress plugin suffers from a stored XSS vulnerability (CWE-79) via the 'sc_styles' parameter in its REST API endpoint /wp-json/maxi-blocks/v1.0/style-card. This flaw allows authenticated users with Author or higher privileges to inject arbitrary JavaScript that executes in the context of any page loading the affected styles, including the admin interface. The vulnerability affects all versions up to 2.1.9. The CVSS 3.1 base score is 6.4 (medium), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial confidentiality and integrity impact. No official fix or patch has been published as of the data provided.

An attacker with Author-level or higher access can exploit this vulnerability to execute arbitrary JavaScript in the context of the WordPress site, potentially leading to session hijacking, privilege escalation, or other malicious actions affecting site administrators and users. The impact is limited to authenticated users with sufficient privileges and does not affect unauthenticated users. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict Author-level access to trusted users only and consider disabling or removing the Maxi Blocks plugin if possible. Monitoring for suspicious activity related to this plugin is advisable. Avoid granting Author or higher privileges to untrusted users to reduce risk.