CVE-2024-2255 is a stored cross-site scripting vulnerability in the wpdevteam Essential Blocks – Page Builder Gutenberg Blocks & Patterns WordPress plugin, affecting all versions up to and including 4.5.3. The issue arises from improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of user-supplied attributes such as listStyle in plugin widgets. This allows authenticated users with contributor-level or higher privileges to inject arbitrary JavaScript that executes in the context of other users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at low level, no user interaction, and impacts confidentiality and integrity with scope changed.

An attacker with contributor-level or higher permissions can inject malicious scripts into pages via vulnerable plugin widgets. These scripts execute when other users access the affected pages, potentially leading to unauthorized actions or data disclosure within the context of the victim's session. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.