This vulnerability (CWE-79) affects ThemeGrill Magazine Blocks, specifically versions up to and including 1.8.6. It allows a contributor-level user to perform cross-site scripting by injecting malicious input that is not properly neutralized during web page generation. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring privileges of a contributor, and user interaction. The impact includes partial confidentiality, integrity, and availability loss. No patch or official remediation level has been published yet.

Successful exploitation could allow an attacker with contributor privileges to execute arbitrary scripts in the context of other users, potentially leading to partial loss of confidentiality, integrity, and availability of the affected application or user data. The vulnerability requires user interaction and contributor-level privileges, limiting the attack surface somewhat.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor privileges to trusted users only and consider additional input validation or filtering at the application level if possible.