EUVD-2026-39164
GHSA-298j-vh9r-mc78
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L confirmed by explicit Contributor requirement; UI:R assessed independently because a victim must load the injected page for payload execution, constituting passive but required user interaction; S:C retained as script executes outside the plugin's authorization domain.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'configurablePrefix' Block Attribute in all versions up to, and including, 6.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in Essential Blocks for WordPress (all versions through 6.1.4) allows authenticated Contributor-level users to permanently embed malicious JavaScript into pages via the configurablePrefix attribute of the Table of Contents block. The payload persists in the database and executes in every subsequent visitor's browser, enabling session hijacking, credential theft, or forced redirects at scale across the site's audience. No public exploit code or CISA KEV listing is present in the available intelligence, but Wordfence's disclosure paired with publicly accessible source-level Trac links substantially lowers the effort required to develop a working exploit.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant. The affected code paths are confirmed by the WordPress plugin Trac repository: TableOfContents.php at lines 245 and 425, and frontend.js at line 448 within the plugin's 6.1.4 tagged release. The configurablePrefix block attribute, which allows contributors to customize the Table of Contents prefix display, is written into rendered page output without adequate sanitization or context-aware escaping. Because the value is persisted in the WordPress post database and reflected in frontend HTML, the attack surface is persistent rather than reflected. The CPE cpe:2.3:a:wpdevteam:gutenberg_essential_blocks_-_page_builder_for_gutenberg_blocks_&_patterns:*:*:*:*:*:*:*:* confirms the vendor is wpdevteam and that all version ranges up to the disclosure boundary are affected.
RemediationAI
No patched release version is confirmed in the available intelligence - the Trac references point exclusively to the 6.1.4 vulnerable tag, and no newer tagged release with a fix is cited. Administrators should immediately check the WordPress plugin dashboard or the official plugin repository for a release newer than 6.1.4 and upgrade as soon as one is available. While awaiting a patch, the most targeted compensating control is to audit and restrict the Contributor role: revoke it from untrusted or unknown users, and disable open user registration if it is not operationally necessary - this directly eliminates the attacker's required entry point (PR:L). If the Essential Blocks plugin supports per-block enable/disable controls, disabling the Table of Contents block removes the specific attack surface without uninstalling the entire plugin. Wordfence's firewall rules may provide virtual patching for sites running the Wordfence plugin; check the advisory page for rule status. Complete plugin removal is the safest interim option when the Table of Contents feature is non-critical to site operation. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0efe8bbd-c1c9-48ed-adab-34c0ac3da8bf for patch confirmation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today