Gutenberg Essential Blocks Page Builder For Gutenberg Blocks Patterns
Monthly
Stored cross-site scripting in the Essential Blocks - Page Builder for Gutenberg Blocks & Patterns WordPress plugin (versions up to and including 6.4.5) allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that executes when a victim views the affected page. The flaw sits in the Google Map block's 'marker' attribute: marker title/content values are stored as JSON and later decoded and concatenated directly into raw HTML by the frontend InfoWindow builder, so it is insufficient input sanitization plus missing output escaping rather than a logic error. It is network-reachable at low complexity with a scope change (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4 Medium); the practical barrier is the Contributor authentication requirement, and no public exploit code was identified at time of analysis. Sites that allow open registration or grant Contributor roles to low-trust users should treat this as a priority upgrade.
Stored Cross-Site Scripting in Essential Blocks for WordPress (all versions through 6.1.4) allows authenticated Contributor-level users to permanently embed malicious JavaScript into pages via the `configurablePrefix` attribute of the Table of Contents block. The payload persists in the database and executes in every subsequent visitor's browser, enabling session hijacking, credential theft, or forced redirects at scale across the site's audience. No public exploit code or CISA KEV listing is present in the available intelligence, but Wordfence's disclosure paired with publicly accessible source-level Trac links substantially lowers the effort required to develop a working exploit.
Stored cross-site scripting in the Essential Blocks - Page Builder for Gutenberg Blocks & Patterns WordPress plugin (versions up to and including 6.4.5) allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that executes when a victim views the affected page. The flaw sits in the Google Map block's 'marker' attribute: marker title/content values are stored as JSON and later decoded and concatenated directly into raw HTML by the frontend InfoWindow builder, so it is insufficient input sanitization plus missing output escaping rather than a logic error. It is network-reachable at low complexity with a scope change (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4 Medium); the practical barrier is the Contributor authentication requirement, and no public exploit code was identified at time of analysis. Sites that allow open registration or grant Contributor roles to low-trust users should treat this as a priority upgrade.
Stored Cross-Site Scripting in Essential Blocks for WordPress (all versions through 6.1.4) allows authenticated Contributor-level users to permanently embed malicious JavaScript into pages via the `configurablePrefix` attribute of the Table of Contents block. The payload persists in the database and executes in every subsequent visitor's browser, enabling session hijacking, credential theft, or forced redirects at scale across the site's audience. No public exploit code or CISA KEV listing is present in the available intelligence, but Wordfence's disclosure paired with publicly accessible source-level Trac links substantially lowers the effort required to develop a working exploit.