What is the CVSS score of CVE-2026-4658?

CVE-2026-4658 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Essential Blocks CVE-2026-4658

EUVD-2026-26733 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-02 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 05:30 vuln.today

EUVD ID Assigned

May 02, 2026 - 05:22 euvd

EUVD-2026-26733

Analysis Generated

May 02, 2026 - 05:22 vuln.today

CVE Published

May 02, 2026 - 05:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Essential Blocks - Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the className, classHook, and blockId attributes in the Add to Cart block (essential-blocks/add-to-cart) in all versions up to, and including, 6.0.4. This is due to insufficient output escaping in the render_callback() function where these attributes are placed into class and data-id HTML attributes using raw sprintf() and implode() without esc_attr() escaping. While the outer wrapper div uses get_block_wrapper_attributes() which properly escapes, the inner divs do not. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Essential Blocks WordPress plugin versions up to 6.0.4 allows authenticated Contributor-level users to inject arbitrary JavaScript into the Add to Cart block via unescaped className, classHook, and blockId attributes, executing malicious scripts in pages viewed by any site visitor. The vulnerability stems from use of raw sprintf() and implode() functions without WordPress escaping functions (esc_attr) in the render_callback() function, despite the outer wrapper using proper escaping. CVSS 6.4 (medium) reflects the requirement for authenticated access; however, the stored nature and cross-site scope elevate real-world risk on multi-author WordPress sites.

Technical ContextAI

Essential Blocks is a WordPress Gutenberg block plugin that extends the block editor with pre-built content blocks. The Add to Cart block (block type: essential-blocks/add-to-cart) renders e-commerce functionality within the WordPress block editor. The vulnerability exists in the render_callback() function (AddToCart.php lines 65, 66, 118, 120) where block attributes (className, classHook, blockId) are directly inserted into HTML class and data-id attributes using sprintf() and implode() without calling WordPress escaping functions. While get_block_wrapper_attributes() properly escapes the outer div, inner div elements bypass escaping, creating stored XSS vectors. CWE-79 (Improper Neutralization of Input During Web Page Generation) classifies this as improper output encoding in dynamically generated HTML content.

RemediationAI

Update Essential Blocks plugin to version 6.1.0 or later immediately - this is the primary remediation and resolves the insufficient output escaping by adding proper esc_attr() calls to className, classHook, and blockId attributes in the render_callback() function. Sites unable to update immediately should restrict Contributor-level access to only trusted authors and disable or hide the Add to Cart block from non-administrator users using role-based access control plugins such as Members or PublishPress Permissions; note this limits block functionality rather than eliminating the vulnerability. Additionally, audit existing Add to Cart blocks for suspicious className or blockId values that may contain script injection attempts and review contributor account activity logs for unauthorized block modifications. Security.wordfence.com provides detailed remediation guidance and integrity checking tools.