The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin contains a stored cross‑site scripting flaw due to inadequate sanitization of the 'titleTag' attribute. Authenticated users with Contributor level or higher can inject arbitrary JavaScript that will execute in the browsers of any visitor who loads the tampered page, potentially compromising confidentiality, integrity, or facilitating phishing or defacement attacks.

Vendors affected are wpdevteam's Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin. All releases up to and including 5.7.1 are vulnerable; any WordPress site using these plugin versions is at risk.

The CVSS base score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, and it requires authenticated Contributor-level access to craft the payload, limiting attacker eligibility. Nevertheless, if an attacker gains such access, the stored payload can persist and affect all users who visit the compromised page.