CVE-2025-1664 is a stored cross-site scripting vulnerability (CWE-79) in the Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates WordPress plugin by wpdevteam. The flaw exists in the Parallax slider component due to improper neutralization of input during web page generation, allowing authenticated users with Contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of users who access the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 5.3.1.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject persistent malicious scripts into pages using the Parallax slider. These scripts execute in the browsers of users who view the injected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access and above to trusted users only, and consider disabling or avoiding use of the Parallax slider feature in the plugin. Monitor the vendor's channels for updates or patches addressing this vulnerability.