Stored XSS via Steps block text attributes

Stored XSS in Steps and Step blocks in Frontend Admin by DynamiApps before 3.29.11 allows remote authenticated users to execute script in visitors' browsers. Public records do not name a function, but the 3.29.11 WordPress.org changelog ties the flaw to the Steps and Step blocks' text attributes, which were stored and later rendered without safe HTML handling. Patchstack lists Contributor as the required privilege and notes user interaction is required, so exploitation depends on a lower-privileged account planting content and another user viewing a page that renders the affected block.