The Essential Blocks – Page Builder Gutenberg Blocks & Patterns WordPress plugin contains a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2025-4682. This vulnerability exists due to improper neutralization of input during web page generation, specifically in HTML attributes within the Slider and Post Carousel widgets. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary scripts that persist in the content and execute in the context of users visiting the infected pages. The vulnerability affects all plugin versions up to and including 5.4.0. The CVSS 3.1 base score is 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject persistent malicious scripts into pages via vulnerable widgets. These scripts execute in the context of any user viewing the affected page, potentially leading to unauthorized actions or data disclosure limited to the scope of the injected script. The impact is rated medium severity with partial confidentiality and integrity loss but no availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level and higher access to trusted users only. Monitor updates from the plugin vendor (wpdevteam) for patches addressing this vulnerability. Avoid using the vulnerable widgets (Slider and Post Carousel) if possible, or sanitize inputs manually as a temporary measure.