CVE-2026-4658: Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the className, classHook, and blockId attributes in the Add to Cart block (essential-blocks/add-to-cart) in all versions up to, and including, 6.0.4. This is due to insufficient output escaping in the rendercallback() function where these attributes are placed into class and data-id HTML attributes using raw sprintf() and implode() without escattr() escaping. While the outer wrapper div uses getblockwrapperattributes() which properly escapes, the inner divs do not. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4658?
CVE-2026-4658 has a high severity rating due to the potential for stored cross-site scripting attacks affecting authenticated users.
How do I fix CVE-2026-4658?
To remediate CVE-2026-4658, update the Essential Blocks plugin for WordPress to version 6.0.5 or later, which addresses the vulnerability.
Who is affected by CVE-2026-4658?
CVE-2026-4658 affects users of the WPDeveloper Essential Blocks plugin for WordPress versions 6.0.4 and earlier.
What type of vulnerability is CVE-2026-4658?
CVE-2026-4658 is classified as a stored cross-site scripting (XSS) vulnerability.
What data can be compromised through CVE-2026-4658?
CVE-2026-4658 can allow attackers to inject malicious scripts, potentially leading to data theft or session hijacking for users with Contributor or higher roles.