Essential Blocks – Page Builder for Gutenberg exposes a stored Cross‑Site Scripting flaw. The Add to Cart block accepts className, classHook, and blockId attributes without escaping before inserting them into class and data-id HTML attributes. This lets an authenticated Contributor or higher inject arbitrary JavaScript that executes when a page containing the block is loaded, potentially compromising user sessions, defacing content, or stealing sensitive data. The weakness is a classic unchecked input leading to content injection, classified as CWE‑79.

The vulnerability exists in all releases of the Gutenberg Essential Blocks plugin up to and including version 6.0.4. WordPress sites using this plugin with any Contributor‑level or higher account are impacted. Versions 6.1.0 and later have applied the fix and are not affected.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score is not available, making the exact likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalogue. Because the flaw requires authenticated access with Contributor-level privileges, an attacker must first gain legitimate site login, then add or modify a block on a page. Once injected, the payload runs in all browsers that load the affected page. Given the moderate CVSS and the necessity of authentication, the overall risk is significant for sites where Contributors have extensive block‑editing rights. Administrators should consider the threat sufficient to warrant immediate remediation.