The Qi Blocks plugin for WordPress up to and including version 1.4.3 has a Missing Authorization vulnerability. This flaw allows authenticated users with Contributor-level access or higher to inject arbitrary CSS via the REST API endpoint `qi-blocks/v1/update-styles`. The injected CSS can be used to manipulate the UI or exfiltrate information through CSS injection techniques.