The CVE describes an authenticated XSS in a WordPress block plugin's 'layoutCircle.alignment' attribute — a specific named parameter in the block's data structure, not a generic input field. The CVSS 6.4 and EPSS 0.00193 create a misleading signal: both metrics were built for mass-scanning infrastructure vulnerabilities, not for supply-chain vectors in a plugin ecosystem where contributor-level access is trivially obtained through credential compromise or legitimate collaboration. The real threat model is a malicious contributor injecting a payload into a shared pattern that dozens of site administrators will unknowingly execute when they insert that block.
Gutenberg's JSON-based block markup creates a cognitive failure mode: developers define 'alignment' attributes with the mental model of a layout constraint, not user content. The save function passes the attribute through to a frontend template, and no security checklist fires because the input domain appears bounded to an enum like 'left', 'center', 'right'. This is not an isolated bug — it's a structural vulnerability pattern. Other block attributes in this plugin (layoutSquare.alignment, layoutImage.alignment, etc.) likely share the same flaw.
Check your block registration's validate callback — this is where the vulnerability should have been caught. The validate function runs server-side during block sanitization and can reject malformed attributes before storage. If 2.2.11 added only a surgical esc_attr() fix at render time without updating the block's validate handler, the plugin remains vulnerable via REST API interactions or block preprocessing hooks.
The 600+ pattern scope creates a second failure mode: pattern libraries store frozen JSON in your site's database. Even a complete patch tomorrow does not retroactively clean patterns saved during vulnerable versions. Audit your pattern library database entries for non-standard alignment values — the payload may already be persisted and waiting to execute.
Prioritize this over the EPSS suggests. The metric is blind to authenticated injection vectors that exploit trust relationships. Contributor-level XSS in a block ecosystem converts a bounded access vector into an asymmetric payload distribution system: inject once into a shared pattern, and every downstream site administrator executes it without interaction.