Essential Blocks EUVD-2026-90594

Requires an authenticated account with Contributor-level privileges or higher on the target WordPress site, and the site must use the Essential Blocks plugin (≤6.4.5) with the Google Map block available in the editor. The attacker inserts a Google Map block and injects script into a marker's title/content attribute; exploitation succeeds without any special non-default configuration beyond having the block placed on a published/previewable page. The limiting factor is the Contributor authentication barrier - sites that do not grant low-trust users contributor roles (or lack open registration) are substantially harder to exploit. Script execution is triggered only when a user (visitor or reviewing editor) views the page containing the injected block.

This is a Stored XSS in a popular WordPress Gutenberg block plugin, rated CVSS 6.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - network-reachable, low complexity, but requiring Contributor-level authentication (PR:L) and no attacker-side user interaction (the victim viewing the page supplies the trigger, reflected in the scope change S:C). EPSS is not provided, there is no CISA KEV listing, and no public exploit code is identified - so exploitation status is 'no public exploit identified at time of analysis'. SSVC framework data is not supplied. The realistic risk is moderate and self-limiting: the PR:L gate means an attacker must already hold a Contributor (or higher) account, which is a meaningful barrier on well-managed sites but trivially met on sites with open/self-registration granting contributor roles. The C:L/I:L/A:N impact reflects browser-context script execution (session/cookie theft, limited DOM manipulation, phishing) rather than server compromise. No signals conflict; this is a genuine-but-not-urgent issue - a confirmed, vendor-patched Medium XSS with no evidence of active exploitation, best handled via normal patch cycles with priority on sites that allow low-trust author accounts.

An attacker holding a Contributor account on a target WordPress site inserts the Essential Blocks Google Map block into a draft and places a malicious script payload in a map marker's title/content field, which is stored as JSON. When any visitor or reviewing editor opens the page, the frontend InfoWindow builder decodes the JSON and concatenates the marker values directly into raw HTML, executing the script in the viewer's browser. No public proof-of-concept is identified at time of analysis.