CVE-2024-1854 is a stored cross-site scripting vulnerability in the Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates WordPress plugin (up to version 4.5.1). It results from improper input validation (CWE-20) of the blockId parameter, which allows authenticated users with contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and limited privileges required.

An authenticated attacker with contributor or higher privileges can exploit this vulnerability to inject stored malicious scripts via the blockId parameter. These scripts execute in the browsers of users who view the compromised pages, potentially leading to information disclosure or integrity impacts such as session hijacking or unauthorized actions performed in the context of the victim user. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider monitoring for suspicious script injections in page content. Avoid granting unnecessary privileges to users who do not require contributor or higher access.