The Master Blocks plugin for WordPress contains an unauthenticated Stored XSS vulnerability that allows remote attackers to compromise administrative sessions.

This vulnerability occurs due to a lack of authorization checks on a REST API route within the plugin. Unauthenticated attackers can update plugin settings with malicious payloads that execute as Stored XSS when an administrator views the affected settings page.

The ability for an unauthenticated attacker to inject scripts into the administrative dashboard poses a severe risk to the integrity of the WordPress environment. Because the payload executes in the context of an administrator session, it could lead to full site takeover, unauthorized user creation, or the exfiltration of sensitive configuration data. The high CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability.

Immediate Action: Update the Master Blocks plugin to version 1.5.0 or later immediately to apply the necessary authorization checks on the affected REST route.

Proactive Monitoring: Monitor server access logs for suspicious requests targeting the plugin REST API endpoints and review administrative logs for unexpected changes to plugin settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious XSS patterns and restrict access to the WordPress REST API for unauthorized users.

Public Exploit Available: Unknown

Given the critical nature of Stored XSS vulnerabilities that impact administrative sessions, organizations using the Master Blocks plugin must prioritize this update. Ensure that all plugins are running the latest patched versions to prevent unauthorized administrative access and potential site compromise.