The Essential Blocks – Page Builder Gutenberg Blocks & Patterns plugin contains a stored cross‑site scripting flaw in the Parallax slider block. Insufficient input sanitization and output escaping allow an attacker who can contribute content to inject arbitrary JavaScript that will run whenever a page containing the block is viewed. This can lead to theft of user credentials, defacement, or the execution of additional malicious code.

Any WordPress site that has the Essential Blocks – Page Builder Gutenberg Blocks & Patterns plugin at version 5.3.1 or earlier is affected. The plugin is granted by the vendor "wpdevteam" and appears in public listings for free WordPress installations.

The vulnerability has a CVSS score of 6.4, indicating a moderate severity, and an EPSS score of less than 1%, suggesting low likelihood of current exploitation. It is not listed in the CISA KEV catalog. Attackers must be authenticated with at least Contributor-level permissions, and the exploit is performed through the plugin’s content editing interface, which is the inferred attack vector. Once successful, the injected script runs in the context of any visitor who loads the compromised page.