The Custom Block Builder WordPress plugin prior to version 4.3.0 contains a CWE-79 Cross-Site Scripting vulnerability due to inconsistent enforcement of the unfiltered_html capability across code paths that write to block template fields. This flaw permits administrators on multisite setups or single-site installs with DISALLOW_UNFILTERED_HTML enabled to inject arbitrary JavaScript code. The malicious script executes in the context of any visitor accessing pages embedding the compromised block, potentially leading to client-side code execution. There is no CVSS score assigned, no patch or official remediation level indicated, and no known active exploitation.

The vulnerability enables administrators with certain configurations to inject arbitrary JavaScript that executes in the browsers of visitors to pages containing the affected block. This could lead to typical XSS impacts such as session hijacking, defacement, or redirection, but only if an attacker has administrative privileges on the affected WordPress installation. No evidence of exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should be cautious about the use of the Custom Block Builder plugin in multisite environments or where DISALLOW_UNFILTERED_HTML is defined. Limiting administrative access and monitoring plugin updates is recommended.