The plugin is vulnerable to stored cross‑site scripting because it fails to properly sanitize or escape HTML attributes within the Slider and Post Carousel widget configuration. This flaw allows an authenticated user with Contributor or higher privileges to inject JavaScript that will execute whenever anyone views the affected page, potentially compromising the browser context for all site visitors.

The vulnerability affects the Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin. All released versions up to and including 5.4.0 are impacted.

The score of 6.4 on the CVSS base indicates moderate severity. The EPSS score of < 1 % suggests low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw is exploitable through the normal WordPress admin interface by users with Contributor-level access or higher, who can add or edit a page using the Slider or Post Carousel widgets and inject malicious script that will run for any visitor to that page.