The Page Builder Gutenberg Blocks – CoBlocks plugin allows an authenticated user with Contributor or higher privileges to insert malicious scripts into page content by exploiting a lack of output escaping for event titles, descriptions, and locations that are pulled from external iCal feeds in the Events block rendering function. The stored script is then delivered to any visitor who views the affected page, giving the attacker a persistent client‑side vulnerability that can be used for phishing, cookie theft, or malicious redirects.

All installations of the Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress running version 3.1.16 or earlier are impacted. The vendor listed in the CNA record is godaddy (the plugin’s name is Page Builder Gutenberg Blocks – CoBlocks).

The vulnerability carries a CVSS base score of 6.4, which places it in the medium severity range. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalogue, indicating that no widespread exploit is reported. Exploitation requires an authenticated Contributor or higher user; attackers can inject arbitrary scripts into event data that is then rendered to all users viewing the page. While no public exploit is currently known, the ability for an attacker to inject persistent scripts poses a moderate risk to site users.