Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize attributes used to define custom attributes for a block. This allows an attacker with the `administer blocks` permission to inject malicious scripts into web pages. Cross-site Scripting is a flaw where untrusted data is inserted into a web page without proper validation or encoding, allowing the execution of scripts in the victim's browser.