The Master Blocks WordPress plugin before version 1.5.0 has an authorization bypass on a REST route, permitting unauthenticated users to modify plugin settings. One such setting is rendered unescaped in the admin interface, resulting in stored cross-site scripting (CWE-79). This vulnerability allows execution of arbitrary scripts in the session of any administrator who accesses the wp-admin area, potentially leading to session hijacking or other malicious actions within the admin context.

Unauthenticated attackers can exploit this vulnerability to inject malicious scripts that execute in the browser session of WordPress administrators. This can lead to administrative account compromise, unauthorized actions within the WordPress backend, or further attacks on the site or network. The impact is significant given the administrative privileges of affected users.

Upgrade the Master Blocks plugin to version 1.5.0 or later, where this vulnerability is fixed. Since the vulnerability is due to missing authorization on a REST route and improper output escaping, applying the official update will remediate the issue. No other mitigation is indicated by the vendor advisory.