CVE-2024-4891 is a stored cross-site scripting vulnerability in the WordPress plugin 'Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates' (versions up to 4.5.12). It results from improper neutralization of input during web page generation, specifically inadequate sanitization and output escaping of the 'tagName' parameter. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary scripts that execute in the context of users viewing the compromised pages. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial impact on confidentiality and integrity.

Successful exploitation allows an authenticated user with contributor or higher permissions to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who access the infected pages, potentially leading to information disclosure and integrity impacts within the affected WordPress site context. Availability is not impacted. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions carefully and monitor for suspicious activity related to page content modifications involving the 'tagName' parameter. Avoid granting unnecessary contributor or higher privileges to untrusted users.